diff --git a/testing/btest/Baseline.inline/broker.store.create-failure/zeek.err b/testing/btest/Baseline.inline/broker.store.create-failure/zeek.err new file mode 100644 index 0000000000..a92ab43b1d --- /dev/null +++ b/testing/btest/Baseline.inline/broker.store.create-failure/zeek.err @@ -0,0 +1,11 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +error in <...>/store.zeek, line 730: Failed to attach master store backend_failure: (Broker::__create_master(Broker::name, Broker::b, Broker::options)) +error in <...>/store.zeek, line 730: Could not create Broker master store '../fail' (Broker::__create_master(Broker::name, Broker::b, Broker::options)) +error in <...>/create-failure.zeek, line 49: invalid Broker store handle (Broker::keys(s) and broker::store::{}) +error in <...>/store.zeek, line 744: invalid Broker store handle (Broker::__close(Broker::h) and broker::store::{}) +error in <...>/store.zeek, line 744: invalid Broker store handle (Broker::__close(Broker::h) and broker::store::{}) +error in <...>/create-failure.zeek, line 49: invalid Broker store handle (Broker::keys(s) and broker::store::{}) +error in <...>/create-failure.zeek, line 49: invalid Broker store handle (Broker::keys(s) and broker::store::{}) +error in <...>/create-failure.zeek, line 49: invalid Broker store handle (Broker::keys(s) and broker::store::{}) +error in <...>/create-failure.zeek, line 49: invalid Broker store handle (Broker::keys(s) and broker::store::{}) +received termination signal diff --git a/testing/btest/Baseline.inline/broker.store.create-failure/zeek.out b/testing/btest/Baseline.inline/broker.store.create-failure/zeek.out new file mode 100644 index 0000000000..dcf0911820 --- /dev/null +++ b/testing/btest/Baseline.inline/broker.store.create-failure/zeek.out @@ -0,0 +1,21 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +T +F +F +F +m1 keys result: [status=Broker::FAILURE, result=[data=]] +m2 keys result: [status=Broker::SUCCESS, result=[data=broker::data{{}}]] +c2 keys result: [status=Broker::SUCCESS, result=[data=broker::data{{}}]] +T +F +F +F +T +T +T +T +m1 keys result: [status=Broker::FAILURE, result=[data=]] +c1 keys result: [status=Broker::FAILURE, result=[data=]] +m2 keys result: [status=Broker::FAILURE, result=[data=]] +c2 keys result: [status=Broker::FAILURE, result=[data=]] +c1 timeout diff --git a/testing/btest/Baseline.inline/broker.store.invalid-handle/out b/testing/btest/Baseline.inline/broker.store.invalid-handle/out deleted file mode 100644 index d79ab1ccca..0000000000 --- a/testing/btest/Baseline.inline/broker.store.invalid-handle/out +++ /dev/null @@ -1,4 +0,0 @@ -### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. -expression error in : invalid Broker store handle (0), during call: (Broker::__is_closed(Broker::h)) -error in <...>/invalid-handle.zeek, line 6: invalid Broker store handle (Broker::keys(a) and 0) -keys, [status=Broker::FAILURE, result=[data=]] diff --git a/testing/btest/Baseline.inline/plugins.hooks/output b/testing/btest/Baseline.inline/plugins.hooks/output index f3a403ad59..690d32175d 100644 --- a/testing/btest/Baseline.inline/plugins.hooks/output +++ b/testing/btest/Baseline.inline/plugins.hooks/output @@ -16,6 +16,7 @@ 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_DTLS, 443/udp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_FTP, 21/tcp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_FTP, 2811/tcp)) -> +0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_GENEVE, 6081/udp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_GTPV1, 2123/udp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_GTPV1, 2152/udp)) -> 0.000000 MetaHookPost CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_HTTP, 1080/tcp)) -> @@ -70,51 +71,51 @@ 0.000000 MetaHookPost CallFunction(Cluster::is_enabled, , ()) -> 0.000000 MetaHookPost CallFunction(Cluster::local_node_type, , ()) -> 0.000000 MetaHookPost CallFunction(FilteredTraceDetection::should_detect, , ()) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Broker::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=broker, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Cluster::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=cluster, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Config::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=config, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Conn::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DCE_RPC::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dce_rpc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DHCP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dhcp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DNP3::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dnp3, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DNS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dns, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DPD::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dpd, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (FTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ftp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Files::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (IRC::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=irc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=intel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::DROP_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_shunt, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Notice::ALARM_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=notice_alarm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Notice::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=notice, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (OpenFlow::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=openflow, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (PE::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=pe, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (RADIUS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=radius, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (RDP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=rdp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (RFB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=rfb, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=reporter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SIP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=sip, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_mapping, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smtp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SNMP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=snmp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SOCKS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=socks, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SSH::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ssh, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SSL::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ssl, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Signatures::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=signatures, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Software::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=software, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Syslog::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=syslog, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Tunnel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=tunnel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Weird::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=weird, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (X509::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=x509, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -0.000000 MetaHookPost CallFunction(Log::__add_filter, , (mysql::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=mysql, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Broker::LOG, [name=default, writer=Log::WRITER_ASCII, path=broker, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Cluster::LOG, [name=default, writer=Log::WRITER_ASCII, path=cluster, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Config::LOG, [name=default, writer=Log::WRITER_ASCII, path=config, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DCE_RPC::LOG, [name=default, writer=Log::WRITER_ASCII, path=dce_rpc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DHCP::LOG, [name=default, writer=Log::WRITER_ASCII, path=dhcp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DNP3::LOG, [name=default, writer=Log::WRITER_ASCII, path=dnp3, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DNS::LOG, [name=default, writer=Log::WRITER_ASCII, path=dns, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (DPD::LOG, [name=default, writer=Log::WRITER_ASCII, path=dpd, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (FTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=ftp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (IRC::LOG, [name=default, writer=Log::WRITER_ASCII, path=irc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Intel::LOG, [name=default, writer=Log::WRITER_ASCII, path=intel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::DROP_LOG, [name=default, writer=Log::WRITER_ASCII, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, path=netcontrol_shunt, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Notice::ALARM_LOG, [name=default, writer=Log::WRITER_ASCII, path=notice_alarm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Notice::LOG, [name=default, writer=Log::WRITER_ASCII, path=notice, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (OpenFlow::LOG, [name=default, writer=Log::WRITER_ASCII, path=openflow, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (PE::LOG, [name=default, writer=Log::WRITER_ASCII, path=pe, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (RADIUS::LOG, [name=default, writer=Log::WRITER_ASCII, path=radius, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (RDP::LOG, [name=default, writer=Log::WRITER_ASCII, path=rdp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (RFB::LOG, [name=default, writer=Log::WRITER_ASCII, path=rfb, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, path=reporter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SIP::LOG, [name=default, writer=Log::WRITER_ASCII, path=sip, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, path=smb_files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, path=smb_mapping, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=smtp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SNMP::LOG, [name=default, writer=Log::WRITER_ASCII, path=snmp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SOCKS::LOG, [name=default, writer=Log::WRITER_ASCII, path=socks, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SSH::LOG, [name=default, writer=Log::WRITER_ASCII, path=ssh, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (SSL::LOG, [name=default, writer=Log::WRITER_ASCII, path=ssl, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Signatures::LOG, [name=default, writer=Log::WRITER_ASCII, path=signatures, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Software::LOG, [name=default, writer=Log::WRITER_ASCII, path=software, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Syslog::LOG, [name=default, writer=Log::WRITER_ASCII, path=syslog, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Tunnel::LOG, [name=default, writer=Log::WRITER_ASCII, path=tunnel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (Weird::LOG, [name=default, writer=Log::WRITER_ASCII, path=weird, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (X509::LOG, [name=default, writer=Log::WRITER_ASCII, path=x509, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(Log::__add_filter, , (mysql::LOG, [name=default, writer=Log::WRITER_ASCII, path=mysql, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Broker::LOG, [columns=Broker::Info, ev=, path=broker, policy=Broker::log_policy])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Cluster::LOG, [columns=Cluster::Info, ev=, path=cluster, policy=Cluster::log_policy])) -> 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Config::LOG, [columns=Config::Info, ev=Config::log_config, path=config, policy=Config::log_policy])) -> @@ -162,91 +163,91 @@ 0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql, policy=MySQL::log_policy])) -> 0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T])) -> 0.000000 MetaHookPost CallFunction(NetControl::init, , ()) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (ActiveHTTP::default_max_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (ActiveHTTP::default_method, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Broker::peer_counts_as_iosource, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Conn::analyzer_inactivity_timeouts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Conn::default_extract, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Conn::extraction_prefix, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Conn::port_inactivity_timeouts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DCE_RPC::ignored_operations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DHCP::max_txid_watch_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DNS::max_pending_msgs, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DNS::max_pending_query_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DPD::ignore_violations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DPD::ignore_violations_after, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DPD::max_violations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Dir::polling_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::cmd_reply_code, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::guest_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::logged_commands, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FileExtract::default_limit, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Files::enable_reassembler, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (GridFTP::max_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (GridFTP::size_threshold, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (GridFTP::skip_data, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::http_methods, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::max_files_orig, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::max_files_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::proxy_headers, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Input::default_mode, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Input::default_reader, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (KRB::ignored_errors, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Log::default_rotation_dir, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (MQTT::max_payload_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (NetControl::default_priority, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::alarmed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::default_suppression_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::emailed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::ignored_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::lookup_location_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::mail_from, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::mail_page_dest, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::mail_subject_prefix, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::not_suppressed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::reply_to, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::sendmail, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (RDP::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (RDP::rdp_check_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SIP::sip_methods, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMB::logged_file_actions, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMTP::mail_path_capture, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SOCKS::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SSH::compression_algorithms, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SSH::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SSL::ct_logs, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SSL::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Signatures::ignored_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Signatures::summary_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::local_admins, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::local_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::local_zones, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::neighbor_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::neighbor_zones, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::private_address_space, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Software::asset_tracking, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::ignore_hosts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_duration, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (ActiveHTTP::default_max_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (ActiveHTTP::default_method, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Broker::peer_counts_as_iosource, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Conn::analyzer_inactivity_timeouts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Conn::default_extract, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Conn::extraction_prefix, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Conn::port_inactivity_timeouts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DCE_RPC::ignored_operations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DHCP::max_txid_watch_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DNS::max_pending_msgs, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DNS::max_pending_query_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DPD::ignore_violations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DPD::ignore_violations_after, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (DPD::max_violations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Dir::polling_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::cmd_reply_code, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::guest_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FTP::logged_commands, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (FileExtract::default_limit, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Files::enable_reassembler, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (GridFTP::max_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (GridFTP::size_threshold, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (GridFTP::skip_data, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::http_methods, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::max_files_orig, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::max_files_resp, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (HTTP::proxy_headers, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Input::default_mode, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Input::default_reader, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (KRB::ignored_errors, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Log::default_rotation_dir, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (MQTT::max_payload_size, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (NetControl::default_priority, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::alarmed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::default_suppression_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::emailed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::ignored_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::lookup_location_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::mail_from, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::mail_page_dest, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::mail_subject_prefix, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::not_suppressed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::reply_to, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Notice::sendmail, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (RDP::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (RDP::rdp_check_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SIP::sip_methods, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMB::logged_file_actions, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SMTP::mail_path_capture, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SOCKS::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SSH::compression_algorithms, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SSH::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SSL::ct_logs, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (SSL::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Signatures::ignored_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Signatures::summary_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::local_admins, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::local_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::local_zones, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::neighbor_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::neighbor_zones, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Site::private_address_space, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Software::asset_tracking, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::ignore_hosts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_duration, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_duration, Config::weird_option_change_interval{ if (Weird::sampling_duration == Config::ID) { Reporter::set_weird_sampling_duration(Config::new_value)}return (Config::new_value)}, 5)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_global_list, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_rate, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_global_list, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_rate, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_rate, Config::weird_option_change_count{ if (Weird::sampling_threshold == Config::ID) { Reporter::set_weird_sampling_threshold(Config::new_value)}elseif (Weird::sampling_rate == Config::ID) { Reporter::set_weird_sampling_rate(Config::new_value)}return (Config::new_value)}, 5)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_threshold, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_threshold, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_threshold, Config::weird_option_change_count{ if (Weird::sampling_threshold == Config::ID) { Reporter::set_weird_sampling_threshold(Config::new_value)}elseif (Weird::sampling_rate == Config::ID) { Reporter::set_weird_sampling_rate(Config::new_value)}return (Config::new_value)}, 5)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_whitelist, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_whitelist, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::sampling_whitelist, Config::weird_option_change_sampling_whitelist{ if (Weird::sampling_whitelist == Config::ID) { Reporter::set_weird_sampling_whitelist(Config::new_value)}return (Config::new_value)}, 5)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::weird_do_not_ignore_repeats, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::caching_required_encounters, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::caching_required_encounters_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::certificate_cache_max_entries, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (ignore_checksums_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> -0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (Weird::weird_do_not_ignore_repeats, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::caching_required_encounters, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::caching_required_encounters_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::certificate_cache_max_entries, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (default_file_bof_buffer_size, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (default_file_timeout_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (ignore_checksums_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> +0.000000 MetaHookPost CallFunction(Option::set_change_handler, , (udp_content_ports, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 2048, PacketAnalyzer::ANALYZER_IP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 2054, PacketAnalyzer::ANALYZER_ARP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 32821, PacketAnalyzer::ANALYZER_ARP)) -> @@ -255,15 +256,20 @@ 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 34887, PacketAnalyzer::ANALYZER_MPLS)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 34916, PacketAnalyzer::ANALYZER_PPPOE)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 34984, PacketAnalyzer::ANALYZER_VLAN)) -> +0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11, 2054, PacketAnalyzer::ANALYZER_ARP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11, 32821, PacketAnalyzer::ANALYZER_ARP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11, 34525, PacketAnalyzer::ANALYZER_IP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11_RADIO, 105, PacketAnalyzer::ANALYZER_IEEE802_11)) -> +0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 1, PacketAnalyzer::ANALYZER_ICMP)) -> +0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 17, PacketAnalyzer::ANALYZER_UDP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 4, PacketAnalyzer::ANALYZER_IPTUNNEL)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 41, PacketAnalyzer::ANALYZER_IPTUNNEL)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 47, PacketAnalyzer::ANALYZER_GRE)) -> +0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 58, PacketAnalyzer::ANALYZER_ICMP)) -> +0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 6, PacketAnalyzer::ANALYZER_TCP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_LINUXSLL, 2048, PacketAnalyzer::ANALYZER_IP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_LINUXSLL, 2054, PacketAnalyzer::ANALYZER_ARP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_LINUXSLL, 32821, PacketAnalyzer::ANALYZER_ARP)) -> @@ -294,7 +300,10 @@ 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VLAN, 34525, PacketAnalyzer::ANALYZER_IP)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VLAN, 34887, PacketAnalyzer::ANALYZER_MPLS)) -> 0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VLAN, 34916, PacketAnalyzer::ANALYZER_PPPOE)) -> -0.000000 MetaHookPost CallFunction(PacketFilter::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VNTAG, 33024, PacketAnalyzer::ANALYZER_VLAN)) -> +0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VNTAG, 34984, PacketAnalyzer::ANALYZER_VLAN)) -> +0.000000 MetaHookPost CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VNTAG, 37120, PacketAnalyzer::ANALYZER_VLAN)) -> +0.000000 MetaHookPost CallFunction(PacketFilter::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> 0.000000 MetaHookPost CallFunction(Pcap::install_pcap_filter, , (PacketFilter::DefaultPcapFilter)) -> 0.000000 MetaHookPost CallFunction(Pcap::precompile_pcap_filter, , (PacketFilter::DefaultPcapFilter, ip or not ip)) -> 0.000000 MetaHookPost CallFunction(SumStats::register_observe_plugins, , ()) -> @@ -317,6 +326,7 @@ 0.000000 MetaHookPost DrainEvents() -> 0.000000 MetaHookPost LoadFile(0, ../main, <...>/main.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ../plugin, <...>/plugin.zeek) -> -1 +0.000000 MetaHookPost LoadFile(0, ./CPP-load.bif.zeek, <...>/CPP-load.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_ARP.events.bif.zeek, <...>/Zeek_ARP.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_AsciiReader.ascii.bif.zeek, <...>/Zeek_AsciiReader.ascii.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_AsciiWriter.ascii.bif.zeek, <...>/Zeek_AsciiWriter.ascii.bif.zeek) -> -1 @@ -343,6 +353,7 @@ 0.000000 MetaHookPost LoadFile(0, ./Zeek_Finger.events.bif.zeek, <...>/Zeek_Finger.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_GSSAPI.events.bif.zeek, <...>/Zeek_GSSAPI.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_GTPv1.events.bif.zeek, <...>/Zeek_GTPv1.events.bif.zeek) -> -1 +0.000000 MetaHookPost LoadFile(0, ./Zeek_Geneve.events.bif.zeek, <...>/Zeek_Geneve.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_Gnutella.events.bif.zeek, <...>/Zeek_Gnutella.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_HTTP.events.bif.zeek, <...>/Zeek_HTTP.events.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./Zeek_HTTP.functions.bif.zeek, <...>/Zeek_HTTP.functions.bif.zeek) -> -1 @@ -509,6 +520,7 @@ 0.000000 MetaHookPost LoadFile(0, ./strings.bif.zeek, <...>/strings.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./sum, <...>/sum.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./supervisor.bif.zeek, <...>/supervisor.bif.zeek) -> -1 +0.000000 MetaHookPost LoadFile(0, ./telemetry.bif.zeek, <...>/telemetry.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./thresholds, <...>/thresholds.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./top-k.bif.zeek, <...>/top-k.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, ./topk, <...>/topk.zeek) -> -1 @@ -539,6 +551,7 @@ 0.000000 MetaHookPost LoadFile(0, base/init-default, <...>/init-default.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base/init-frameworks-and-bifs.zeek, <...>/init-frameworks-and-bifs.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base/packet-protocols, <...>/packet-protocols) -> -1 +0.000000 MetaHookPost LoadFile(0, base<...>/CPP-load.bif, <...>/CPP-load.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/Zeek_KRB.types.bif, <...>/Zeek_KRB.types.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/Zeek_SNMP.types.bif, <...>/Zeek_SNMP.types.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/active-http, <...>/active-http.zeek) -> -1 @@ -580,6 +593,7 @@ 0.000000 MetaHookPost LoadFile(0, base<...>/hash, <...>/hash) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/hash_hrw, <...>/hash_hrw.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/http, <...>/http) -> -1 +0.000000 MetaHookPost LoadFile(0, base<...>/icmp, <...>/icmp) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/ieee802_11, <...>/ieee802_11) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/ieee802_11_radio, <...>/ieee802_11_radio) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/imap, <...>/imap) -> -1 @@ -644,14 +658,17 @@ 0.000000 MetaHookPost LoadFile(0, base<...>/supervisor, <...>/supervisor) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/supervisor.bif, <...>/supervisor.bif.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/syslog, <...>/syslog) -> -1 +0.000000 MetaHookPost LoadFile(0, base<...>/tcp, <...>/tcp) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/thresholds, <...>/thresholds.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/time, <...>/time.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/tunnels, <...>/tunnels) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/types.bif, <...>/types.bif.zeek) -> -1 +0.000000 MetaHookPost LoadFile(0, base<...>/udp, <...>/udp) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/urls, <...>/urls.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/utils, <...>/utils.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/version, <...>/version.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/vlan, <...>/vlan) -> -1 +0.000000 MetaHookPost LoadFile(0, base<...>/vntag, <...>/vntag) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/weird, <...>/weird.zeek) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/x509, <...>/x509) -> -1 0.000000 MetaHookPost LoadFile(0, base<...>/xmpp, <...>/xmpp) -> -1 @@ -690,6 +707,7 @@ 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_DTLS, 443/udp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_FTP, 21/tcp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_FTP, 2811/tcp)) +0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_GENEVE, 6081/udp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_GTPV1, 2123/udp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_GTPV1, 2152/udp)) 0.000000 MetaHookPre CallFunction(Analyzer::__register_for_port, , (Analyzer::ANALYZER_HTTP, 1080/tcp)) @@ -744,51 +762,51 @@ 0.000000 MetaHookPre CallFunction(Cluster::is_enabled, , ()) 0.000000 MetaHookPre CallFunction(Cluster::local_node_type, , ()) 0.000000 MetaHookPre CallFunction(FilteredTraceDetection::should_detect, , ()) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Broker::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=broker, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Cluster::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=cluster, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Config::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=config, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Conn::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DCE_RPC::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dce_rpc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DHCP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dhcp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DNP3::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dnp3, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DNS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dns, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DPD::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dpd, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (FTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ftp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Files::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (IRC::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=irc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=intel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::DROP_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_shunt, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Notice::ALARM_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=notice_alarm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Notice::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=notice, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (OpenFlow::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=openflow, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (PE::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=pe, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (RADIUS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=radius, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (RDP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=rdp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (RFB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=rfb, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=reporter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SIP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=sip, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_mapping, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smtp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SNMP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=snmp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SOCKS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=socks, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SSH::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ssh, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SSL::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ssl, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Signatures::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=signatures, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Software::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=software, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Syslog::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=syslog, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Tunnel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=tunnel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Weird::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=weird, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (X509::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=x509, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -0.000000 MetaHookPre CallFunction(Log::__add_filter, , (mysql::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=mysql, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Broker::LOG, [name=default, writer=Log::WRITER_ASCII, path=broker, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Cluster::LOG, [name=default, writer=Log::WRITER_ASCII, path=cluster, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Config::LOG, [name=default, writer=Log::WRITER_ASCII, path=config, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DCE_RPC::LOG, [name=default, writer=Log::WRITER_ASCII, path=dce_rpc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DHCP::LOG, [name=default, writer=Log::WRITER_ASCII, path=dhcp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DNP3::LOG, [name=default, writer=Log::WRITER_ASCII, path=dnp3, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DNS::LOG, [name=default, writer=Log::WRITER_ASCII, path=dns, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (DPD::LOG, [name=default, writer=Log::WRITER_ASCII, path=dpd, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (FTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=ftp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (IRC::LOG, [name=default, writer=Log::WRITER_ASCII, path=irc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Intel::LOG, [name=default, writer=Log::WRITER_ASCII, path=intel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (KRB::LOG, [name=default, writer=Log::WRITER_ASCII, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::DROP_LOG, [name=default, writer=Log::WRITER_ASCII, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, path=netcontrol_shunt, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Notice::ALARM_LOG, [name=default, writer=Log::WRITER_ASCII, path=notice_alarm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Notice::LOG, [name=default, writer=Log::WRITER_ASCII, path=notice, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (OpenFlow::LOG, [name=default, writer=Log::WRITER_ASCII, path=openflow, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (PE::LOG, [name=default, writer=Log::WRITER_ASCII, path=pe, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (RADIUS::LOG, [name=default, writer=Log::WRITER_ASCII, path=radius, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (RDP::LOG, [name=default, writer=Log::WRITER_ASCII, path=rdp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (RFB::LOG, [name=default, writer=Log::WRITER_ASCII, path=rfb, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, path=reporter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SIP::LOG, [name=default, writer=Log::WRITER_ASCII, path=sip, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, path=smb_files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, path=smb_mapping, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=smtp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SNMP::LOG, [name=default, writer=Log::WRITER_ASCII, path=snmp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SOCKS::LOG, [name=default, writer=Log::WRITER_ASCII, path=socks, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SSH::LOG, [name=default, writer=Log::WRITER_ASCII, path=ssh, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (SSL::LOG, [name=default, writer=Log::WRITER_ASCII, path=ssl, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Signatures::LOG, [name=default, writer=Log::WRITER_ASCII, path=signatures, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Software::LOG, [name=default, writer=Log::WRITER_ASCII, path=software, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Syslog::LOG, [name=default, writer=Log::WRITER_ASCII, path=syslog, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Tunnel::LOG, [name=default, writer=Log::WRITER_ASCII, path=tunnel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (Weird::LOG, [name=default, writer=Log::WRITER_ASCII, path=weird, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (X509::LOG, [name=default, writer=Log::WRITER_ASCII, path=x509, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(Log::__add_filter, , (mysql::LOG, [name=default, writer=Log::WRITER_ASCII, path=mysql, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Broker::LOG, [columns=Broker::Info, ev=, path=broker, policy=Broker::log_policy])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Cluster::LOG, [columns=Cluster::Info, ev=, path=cluster, policy=Cluster::log_policy])) 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Config::LOG, [columns=Config::Info, ev=Config::log_config, path=config, policy=Config::log_policy])) @@ -836,91 +854,91 @@ 0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql, policy=MySQL::log_policy])) 0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T])) 0.000000 MetaHookPre CallFunction(NetControl::init, , ()) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (ActiveHTTP::default_max_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (ActiveHTTP::default_method, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Broker::peer_counts_as_iosource, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Conn::analyzer_inactivity_timeouts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Conn::default_extract, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Conn::extraction_prefix, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Conn::port_inactivity_timeouts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DCE_RPC::ignored_operations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DHCP::max_txid_watch_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DNS::max_pending_msgs, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DNS::max_pending_query_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DPD::ignore_violations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DPD::ignore_violations_after, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DPD::max_violations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Dir::polling_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::cmd_reply_code, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::guest_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::logged_commands, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FileExtract::default_limit, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Files::enable_reassembler, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (GridFTP::max_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (GridFTP::size_threshold, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (GridFTP::skip_data, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::http_methods, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::max_files_orig, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::max_files_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::proxy_headers, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Input::default_mode, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Input::default_reader, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (KRB::ignored_errors, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Log::default_rotation_dir, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (MQTT::max_payload_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (NetControl::default_priority, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::alarmed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::default_suppression_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::emailed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::ignored_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::lookup_location_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::mail_from, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::mail_page_dest, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::mail_subject_prefix, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::not_suppressed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::reply_to, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::sendmail, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (RDP::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (RDP::rdp_check_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SIP::sip_methods, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMB::logged_file_actions, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMTP::mail_path_capture, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SOCKS::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SSH::compression_algorithms, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SSH::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SSL::ct_logs, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SSL::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Signatures::ignored_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Signatures::summary_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::local_admins, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::local_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::local_zones, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::neighbor_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::neighbor_zones, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::private_address_space, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Software::asset_tracking, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::ignore_hosts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_duration, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (ActiveHTTP::default_max_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (ActiveHTTP::default_method, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Broker::peer_counts_as_iosource, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Conn::analyzer_inactivity_timeouts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Conn::default_extract, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Conn::extraction_prefix, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Conn::port_inactivity_timeouts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DCE_RPC::ignored_operations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DHCP::max_txid_watch_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DNS::max_pending_msgs, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DNS::max_pending_query_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DPD::ignore_violations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DPD::ignore_violations_after, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (DPD::max_violations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Dir::polling_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::cmd_reply_code, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::guest_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FTP::logged_commands, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (FileExtract::default_limit, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Files::enable_reassembler, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (GridFTP::max_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (GridFTP::size_threshold, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (GridFTP::skip_data, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::http_methods, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::max_files_orig, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::max_files_resp, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (HTTP::proxy_headers, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Input::default_mode, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Input::default_reader, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (KRB::ignored_errors, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Log::default_rotation_dir, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (MQTT::max_payload_size, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (NetControl::default_priority, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::alarmed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::default_suppression_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::emailed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::ignored_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::lookup_location_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::mail_from, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::mail_page_dest, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::mail_subject_prefix, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::not_suppressed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::reply_to, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Notice::sendmail, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (RDP::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (RDP::rdp_check_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SIP::sip_methods, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMB::logged_file_actions, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SMTP::mail_path_capture, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SOCKS::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SSH::compression_algorithms, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SSH::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SSL::ct_logs, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (SSL::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Signatures::ignored_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Signatures::summary_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::local_admins, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::local_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::local_zones, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::neighbor_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::neighbor_zones, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Site::private_address_space, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Software::asset_tracking, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::ignore_hosts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_duration, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_duration, Config::weird_option_change_interval{ if (Weird::sampling_duration == Config::ID) { Reporter::set_weird_sampling_duration(Config::new_value)}return (Config::new_value)}, 5)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_global_list, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_rate, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_global_list, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_rate, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_rate, Config::weird_option_change_count{ if (Weird::sampling_threshold == Config::ID) { Reporter::set_weird_sampling_threshold(Config::new_value)}elseif (Weird::sampling_rate == Config::ID) { Reporter::set_weird_sampling_rate(Config::new_value)}return (Config::new_value)}, 5)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_threshold, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_threshold, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_threshold, Config::weird_option_change_count{ if (Weird::sampling_threshold == Config::ID) { Reporter::set_weird_sampling_threshold(Config::new_value)}elseif (Weird::sampling_rate == Config::ID) { Reporter::set_weird_sampling_rate(Config::new_value)}return (Config::new_value)}, 5)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_whitelist, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_whitelist, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::sampling_whitelist, Config::weird_option_change_sampling_whitelist{ if (Weird::sampling_whitelist == Config::ID) { Reporter::set_weird_sampling_whitelist(Config::new_value)}return (Config::new_value)}, 5)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::weird_do_not_ignore_repeats, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::caching_required_encounters, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::caching_required_encounters_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::certificate_cache_max_entries, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (ignore_checksums_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) -0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (Weird::weird_do_not_ignore_repeats, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::caching_required_encounters, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::caching_required_encounters_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::certificate_cache_max_entries, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (default_file_bof_buffer_size, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (default_file_timeout_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (ignore_checksums_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) +0.000000 MetaHookPre CallFunction(Option::set_change_handler, , (udp_content_ports, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 2048, PacketAnalyzer::ANALYZER_IP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 2054, PacketAnalyzer::ANALYZER_ARP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 32821, PacketAnalyzer::ANALYZER_ARP)) @@ -929,15 +947,20 @@ 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 34887, PacketAnalyzer::ANALYZER_MPLS)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 34916, PacketAnalyzer::ANALYZER_PPPOE)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 34984, PacketAnalyzer::ANALYZER_VLAN)) +0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11, 2054, PacketAnalyzer::ANALYZER_ARP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11, 32821, PacketAnalyzer::ANALYZER_ARP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11, 34525, PacketAnalyzer::ANALYZER_IP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IEEE802_11_RADIO, 105, PacketAnalyzer::ANALYZER_IEEE802_11)) +0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 1, PacketAnalyzer::ANALYZER_ICMP)) +0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 17, PacketAnalyzer::ANALYZER_UDP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 4, PacketAnalyzer::ANALYZER_IPTUNNEL)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 41, PacketAnalyzer::ANALYZER_IPTUNNEL)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 47, PacketAnalyzer::ANALYZER_GRE)) +0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 58, PacketAnalyzer::ANALYZER_ICMP)) +0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_IP, 6, PacketAnalyzer::ANALYZER_TCP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_LINUXSLL, 2048, PacketAnalyzer::ANALYZER_IP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_LINUXSLL, 2054, PacketAnalyzer::ANALYZER_ARP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_LINUXSLL, 32821, PacketAnalyzer::ANALYZER_ARP)) @@ -968,7 +991,10 @@ 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VLAN, 34525, PacketAnalyzer::ANALYZER_IP)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VLAN, 34887, PacketAnalyzer::ANALYZER_MPLS)) 0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VLAN, 34916, PacketAnalyzer::ANALYZER_PPPOE)) -0.000000 MetaHookPre CallFunction(PacketFilter::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VNTAG, 33024, PacketAnalyzer::ANALYZER_VLAN)) +0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VNTAG, 34984, PacketAnalyzer::ANALYZER_VLAN)) +0.000000 MetaHookPre CallFunction(PacketAnalyzer::register_packet_analyzer, , (PacketAnalyzer::ANALYZER_VNTAG, 37120, PacketAnalyzer::ANALYZER_VLAN)) +0.000000 MetaHookPre CallFunction(PacketFilter::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) 0.000000 MetaHookPre CallFunction(Pcap::install_pcap_filter, , (PacketFilter::DefaultPcapFilter)) 0.000000 MetaHookPre CallFunction(Pcap::precompile_pcap_filter, , (PacketFilter::DefaultPcapFilter, ip or not ip)) 0.000000 MetaHookPre CallFunction(SumStats::register_observe_plugins, , ()) @@ -991,6 +1017,7 @@ 0.000000 MetaHookPre DrainEvents() 0.000000 MetaHookPre LoadFile(0, ../main, <...>/main.zeek) 0.000000 MetaHookPre LoadFile(0, ../plugin, <...>/plugin.zeek) +0.000000 MetaHookPre LoadFile(0, ./CPP-load.bif.zeek, <...>/CPP-load.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_ARP.events.bif.zeek, <...>/Zeek_ARP.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_AsciiReader.ascii.bif.zeek, <...>/Zeek_AsciiReader.ascii.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_AsciiWriter.ascii.bif.zeek, <...>/Zeek_AsciiWriter.ascii.bif.zeek) @@ -1017,6 +1044,7 @@ 0.000000 MetaHookPre LoadFile(0, ./Zeek_Finger.events.bif.zeek, <...>/Zeek_Finger.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_GSSAPI.events.bif.zeek, <...>/Zeek_GSSAPI.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_GTPv1.events.bif.zeek, <...>/Zeek_GTPv1.events.bif.zeek) +0.000000 MetaHookPre LoadFile(0, ./Zeek_Geneve.events.bif.zeek, <...>/Zeek_Geneve.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_Gnutella.events.bif.zeek, <...>/Zeek_Gnutella.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_HTTP.events.bif.zeek, <...>/Zeek_HTTP.events.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./Zeek_HTTP.functions.bif.zeek, <...>/Zeek_HTTP.functions.bif.zeek) @@ -1183,6 +1211,7 @@ 0.000000 MetaHookPre LoadFile(0, ./strings.bif.zeek, <...>/strings.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./sum, <...>/sum.zeek) 0.000000 MetaHookPre LoadFile(0, ./supervisor.bif.zeek, <...>/supervisor.bif.zeek) +0.000000 MetaHookPre LoadFile(0, ./telemetry.bif.zeek, <...>/telemetry.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./thresholds, <...>/thresholds.zeek) 0.000000 MetaHookPre LoadFile(0, ./top-k.bif.zeek, <...>/top-k.bif.zeek) 0.000000 MetaHookPre LoadFile(0, ./topk, <...>/topk.zeek) @@ -1213,6 +1242,7 @@ 0.000000 MetaHookPre LoadFile(0, base/init-default, <...>/init-default.zeek) 0.000000 MetaHookPre LoadFile(0, base/init-frameworks-and-bifs.zeek, <...>/init-frameworks-and-bifs.zeek) 0.000000 MetaHookPre LoadFile(0, base/packet-protocols, <...>/packet-protocols) +0.000000 MetaHookPre LoadFile(0, base<...>/CPP-load.bif, <...>/CPP-load.bif.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/Zeek_KRB.types.bif, <...>/Zeek_KRB.types.bif.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/Zeek_SNMP.types.bif, <...>/Zeek_SNMP.types.bif.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/active-http, <...>/active-http.zeek) @@ -1254,6 +1284,7 @@ 0.000000 MetaHookPre LoadFile(0, base<...>/hash, <...>/hash) 0.000000 MetaHookPre LoadFile(0, base<...>/hash_hrw, <...>/hash_hrw.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/http, <...>/http) +0.000000 MetaHookPre LoadFile(0, base<...>/icmp, <...>/icmp) 0.000000 MetaHookPre LoadFile(0, base<...>/ieee802_11, <...>/ieee802_11) 0.000000 MetaHookPre LoadFile(0, base<...>/ieee802_11_radio, <...>/ieee802_11_radio) 0.000000 MetaHookPre LoadFile(0, base<...>/imap, <...>/imap) @@ -1318,14 +1349,17 @@ 0.000000 MetaHookPre LoadFile(0, base<...>/supervisor, <...>/supervisor) 0.000000 MetaHookPre LoadFile(0, base<...>/supervisor.bif, <...>/supervisor.bif.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/syslog, <...>/syslog) +0.000000 MetaHookPre LoadFile(0, base<...>/tcp, <...>/tcp) 0.000000 MetaHookPre LoadFile(0, base<...>/thresholds, <...>/thresholds.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/time, <...>/time.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/tunnels, <...>/tunnels) 0.000000 MetaHookPre LoadFile(0, base<...>/types.bif, <...>/types.bif.zeek) +0.000000 MetaHookPre LoadFile(0, base<...>/udp, <...>/udp) 0.000000 MetaHookPre LoadFile(0, base<...>/urls, <...>/urls.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/utils, <...>/utils.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/version, <...>/version.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/vlan, <...>/vlan) +0.000000 MetaHookPre LoadFile(0, base<...>/vntag, <...>/vntag) 0.000000 MetaHookPre LoadFile(0, base<...>/weird, <...>/weird.zeek) 0.000000 MetaHookPre LoadFile(0, base<...>/x509, <...>/x509) 0.000000 MetaHookPre LoadFile(0, base<...>/xmpp, <...>/xmpp) @@ -1364,6 +1398,7 @@ 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_DTLS, 443/udp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_FTP, 21/tcp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_FTP, 2811/tcp) +0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_GENEVE, 6081/udp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_GTPV1, 2123/udp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_GTPV1, 2152/udp) 0.000000 | HookCallFunction Analyzer::__register_for_port(Analyzer::ANALYZER_HTTP, 1080/tcp) @@ -1417,51 +1452,51 @@ 0.000000 | HookCallFunction Cluster::is_enabled() 0.000000 | HookCallFunction Cluster::local_node_type() 0.000000 | HookCallFunction FilteredTraceDetection::should_detect() -0.000000 | HookCallFunction Log::__add_filter(Broker::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=broker, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Cluster::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=cluster, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Config::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=config, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Conn::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(DCE_RPC::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dce_rpc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(DHCP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dhcp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(DNP3::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dnp3, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(DNS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dns, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(DPD::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=dpd, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(FTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ftp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Files::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(IRC::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=irc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Intel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=intel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(KRB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(NTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(NetControl::DROP_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, pred=, path=netcontrol_shunt, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Notice::ALARM_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=notice_alarm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Notice::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=notice, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(OpenFlow::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=openflow, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(PE::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=pe, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(RADIUS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=radius, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(RDP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=rdp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(RFB::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=rfb, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=reporter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(SIP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=sip, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smb_mapping, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=smtp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(SNMP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=snmp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(SOCKS::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=socks, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(SSH::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ssh, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(SSL::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=ssl, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Signatures::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=signatures, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Software::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=software, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Syslog::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=syslog, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Tunnel::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=tunnel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(Weird::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=weird, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(X509::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=x509, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -0.000000 | HookCallFunction Log::__add_filter(mysql::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=mysql, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Broker::LOG, [name=default, writer=Log::WRITER_ASCII, path=broker, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Cluster::LOG, [name=default, writer=Log::WRITER_ASCII, path=cluster, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Config::LOG, [name=default, writer=Log::WRITER_ASCII, path=config, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(DCE_RPC::LOG, [name=default, writer=Log::WRITER_ASCII, path=dce_rpc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(DHCP::LOG, [name=default, writer=Log::WRITER_ASCII, path=dhcp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(DNP3::LOG, [name=default, writer=Log::WRITER_ASCII, path=dnp3, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(DNS::LOG, [name=default, writer=Log::WRITER_ASCII, path=dns, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(DPD::LOG, [name=default, writer=Log::WRITER_ASCII, path=dpd, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(FTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=ftp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(IRC::LOG, [name=default, writer=Log::WRITER_ASCII, path=irc, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Intel::LOG, [name=default, writer=Log::WRITER_ASCII, path=intel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(KRB::LOG, [name=default, writer=Log::WRITER_ASCII, path=kerberos, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Modbus::LOG, [name=default, writer=Log::WRITER_ASCII, path=modbus, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(NTLM::LOG, [name=default, writer=Log::WRITER_ASCII, path=ntlm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(NTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=ntp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(NetControl::DROP_LOG, [name=default, writer=Log::WRITER_ASCII, path=netcontrol_drop, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(NetControl::LOG, [name=default, writer=Log::WRITER_ASCII, path=netcontrol, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(NetControl::SHUNT, [name=default, writer=Log::WRITER_ASCII, path=netcontrol_shunt, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Notice::ALARM_LOG, [name=default, writer=Log::WRITER_ASCII, path=notice_alarm, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Notice::LOG, [name=default, writer=Log::WRITER_ASCII, path=notice, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(OpenFlow::LOG, [name=default, writer=Log::WRITER_ASCII, path=openflow, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(PE::LOG, [name=default, writer=Log::WRITER_ASCII, path=pe, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(RADIUS::LOG, [name=default, writer=Log::WRITER_ASCII, path=radius, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(RDP::LOG, [name=default, writer=Log::WRITER_ASCII, path=rdp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(RFB::LOG, [name=default, writer=Log::WRITER_ASCII, path=rfb, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Reporter::LOG, [name=default, writer=Log::WRITER_ASCII, path=reporter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(SIP::LOG, [name=default, writer=Log::WRITER_ASCII, path=sip, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(SMB::FILES_LOG, [name=default, writer=Log::WRITER_ASCII, path=smb_files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(SMB::MAPPING_LOG, [name=default, writer=Log::WRITER_ASCII, path=smb_mapping, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(SMTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=smtp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(SNMP::LOG, [name=default, writer=Log::WRITER_ASCII, path=snmp, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(SOCKS::LOG, [name=default, writer=Log::WRITER_ASCII, path=socks, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(SSH::LOG, [name=default, writer=Log::WRITER_ASCII, path=ssh, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(SSL::LOG, [name=default, writer=Log::WRITER_ASCII, path=ssl, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Signatures::LOG, [name=default, writer=Log::WRITER_ASCII, path=signatures, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Software::LOG, [name=default, writer=Log::WRITER_ASCII, path=software, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Syslog::LOG, [name=default, writer=Log::WRITER_ASCII, path=syslog, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Tunnel::LOG, [name=default, writer=Log::WRITER_ASCII, path=tunnel, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(Weird::LOG, [name=default, writer=Log::WRITER_ASCII, path=weird, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(X509::LOG, [name=default, writer=Log::WRITER_ASCII, path=x509, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction Log::__add_filter(mysql::LOG, [name=default, writer=Log::WRITER_ASCII, path=mysql, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) 0.000000 | HookCallFunction Log::__create_stream(Broker::LOG, [columns=Broker::Info, ev=, path=broker, policy=Broker::log_policy]) 0.000000 | HookCallFunction Log::__create_stream(Cluster::LOG, [columns=Cluster::Info, ev=, path=cluster, policy=Cluster::log_policy]) 0.000000 | HookCallFunction Log::__create_stream(Config::LOG, [columns=Config::Info, ev=Config::log_config, path=config, policy=Config::log_policy]) @@ -1509,91 +1544,91 @@ 0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=MySQL::Info, ev=MySQL::log_mysql, path=mysql, policy=MySQL::log_policy]) 0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T]) 0.000000 | HookCallFunction NetControl::init() -0.000000 | HookCallFunction Option::set_change_handler(ActiveHTTP::default_max_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(ActiveHTTP::default_method, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Broker::peer_counts_as_iosource, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Conn::analyzer_inactivity_timeouts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Conn::default_extract, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Conn::extraction_prefix, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Conn::port_inactivity_timeouts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(DCE_RPC::ignored_operations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(DHCP::max_txid_watch_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(DNS::max_pending_msgs, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(DNS::max_pending_query_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(DPD::ignore_violations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(DPD::ignore_violations_after, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(DPD::max_violations, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Dir::polling_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(FTP::cmd_reply_code, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(FTP::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(FTP::guest_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(FTP::logged_commands, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(FileExtract::default_limit, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Files::enable_reassembler, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(GridFTP::max_time, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(GridFTP::size_threshold, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(GridFTP::skip_data, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(HTTP::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(HTTP::http_methods, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(HTTP::max_files_orig, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(HTTP::max_files_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(HTTP::proxy_headers, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Input::default_mode, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Input::default_reader, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(KRB::ignored_errors, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Log::default_rotation_dir, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(MQTT::max_payload_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(NetControl::default_priority, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::alarmed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::default_suppression_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::emailed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::ignored_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::lookup_location_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::mail_from, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::mail_page_dest, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::mail_subject_prefix, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::not_suppressed_types, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::reply_to, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Notice::sendmail, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(RDP::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(RDP::rdp_check_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(SIP::sip_methods, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(SMB::logged_file_actions, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(SMTP::mail_path_capture, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(SOCKS::default_capture_password, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(SSH::compression_algorithms, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(SSH::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(SSL::ct_logs, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(SSL::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Signatures::ignored_ids, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Signatures::summary_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Site::local_admins, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Site::local_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Site::local_zones, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Site::neighbor_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Site::neighbor_zones, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Site::private_address_space, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Software::asset_tracking, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Weird::ignore_hosts, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_duration, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(ActiveHTTP::default_max_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(ActiveHTTP::default_method, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Broker::peer_counts_as_iosource, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Conn::analyzer_inactivity_timeouts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Conn::default_extract, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Conn::extraction_prefix, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Conn::port_inactivity_timeouts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(DCE_RPC::ignored_operations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(DHCP::max_txid_watch_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(DNS::max_pending_msgs, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(DNS::max_pending_query_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(DPD::ignore_violations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(DPD::ignore_violations_after, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(DPD::max_violations, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Dir::polling_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(FTP::cmd_reply_code, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(FTP::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(FTP::guest_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(FTP::logged_commands, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(FileExtract::default_limit, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Files::enable_reassembler, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(GridFTP::max_time, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(GridFTP::size_threshold, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(GridFTP::skip_data, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(HTTP::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(HTTP::http_methods, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(HTTP::max_files_orig, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(HTTP::max_files_resp, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(HTTP::proxy_headers, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Input::default_mode, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Input::default_reader, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(KRB::ignored_errors, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Log::default_rotation_dir, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(MQTT::max_payload_size, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(NetControl::default_priority, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::alarmed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::default_suppression_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::emailed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::ignored_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::lookup_location_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::mail_from, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::mail_page_dest, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::mail_subject_prefix, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::not_suppressed_types, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::reply_to, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Notice::sendmail, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(RDP::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(RDP::rdp_check_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SIP::sip_methods, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SMB::logged_file_actions, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SMTP::mail_path_capture, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SOCKS::default_capture_password, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SSH::compression_algorithms, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SSH::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SSL::ct_logs, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(SSL::disable_analyzer_after_detection, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Signatures::ignored_ids, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Signatures::summary_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Site::local_admins, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Site::local_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Site::local_zones, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Site::neighbor_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Site::neighbor_zones, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Site::private_address_space, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Software::asset_tracking, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Weird::ignore_hosts, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_duration, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_duration, Config::weird_option_change_interval{ if (Weird::sampling_duration == Config::ID) { Reporter::set_weird_sampling_duration(Config::new_value)}return (Config::new_value)}, 5) -0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_global_list, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_rate, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_global_list, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_rate, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_rate, Config::weird_option_change_count{ if (Weird::sampling_threshold == Config::ID) { Reporter::set_weird_sampling_threshold(Config::new_value)}elseif (Weird::sampling_rate == Config::ID) { Reporter::set_weird_sampling_rate(Config::new_value)}return (Config::new_value)}, 5) -0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_threshold, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_threshold, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_threshold, Config::weird_option_change_count{ if (Weird::sampling_threshold == Config::ID) { Reporter::set_weird_sampling_threshold(Config::new_value)}elseif (Weird::sampling_rate == Config::ID) { Reporter::set_weird_sampling_rate(Config::new_value)}return (Config::new_value)}, 5) -0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_whitelist, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_whitelist, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction Option::set_change_handler(Weird::sampling_whitelist, Config::weird_option_change_sampling_whitelist{ if (Weird::sampling_whitelist == Config::ID) { Reporter::set_weird_sampling_whitelist(Config::new_value)}return (Config::new_value)}, 5) -0.000000 | HookCallFunction Option::set_change_handler(Weird::weird_do_not_ignore_repeats, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(X509::caching_required_encounters, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(X509::caching_required_encounters_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(X509::certificate_cache_max_entries, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(default_file_bof_buffer_size, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(default_file_timeout_interval, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(ignore_checksums_nets, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) -0.000000 | HookCallFunction Option::set_change_handler(udp_content_ports, Config::config_option_changed{ Config::log = (coerce [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)] to Config::Info)if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, Config::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(Weird::weird_do_not_ignore_repeats, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(X509::caching_required_encounters, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(X509::caching_required_encounters_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(X509::certificate_cache_max_entries, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(X509::certificate_cache_minimum_eviction_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(default_file_bof_buffer_size, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(default_file_timeout_interval, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(ignore_checksums_nets, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(udp_content_delivery_ports_use_resp, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) +0.000000 | HookCallFunction Option::set_change_handler(udp_content_ports, Config::config_option_changed{ Config::log = [$ts=network_time(), $id=Config::ID, $old_value=Config::format_value(lookup_ID(Config::ID)), $new_value=Config::format_value(Config::new_value)]if ( != Config::location) Config::log$location = Config::locationLog::write(Config::LOG, to_any_coerceConfig::log)return (Config::new_value)}, -100) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 2048, PacketAnalyzer::ANALYZER_IP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 2054, PacketAnalyzer::ANALYZER_ARP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 32821, PacketAnalyzer::ANALYZER_ARP) @@ -1602,15 +1637,20 @@ 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 34887, PacketAnalyzer::ANALYZER_MPLS) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 34916, PacketAnalyzer::ANALYZER_PPPOE) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 34984, PacketAnalyzer::ANALYZER_VLAN) +0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 35110, PacketAnalyzer::ANALYZER_VNTAG) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_ETHERNET, 37120, PacketAnalyzer::ANALYZER_VLAN) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 2048, PacketAnalyzer::ANALYZER_IP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 2054, PacketAnalyzer::ANALYZER_ARP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 32821, PacketAnalyzer::ANALYZER_ARP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11, 34525, PacketAnalyzer::ANALYZER_IP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IEEE802_11_RADIO, 105, PacketAnalyzer::ANALYZER_IEEE802_11) +0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IP, 1, PacketAnalyzer::ANALYZER_ICMP) +0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IP, 17, PacketAnalyzer::ANALYZER_UDP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IP, 4, PacketAnalyzer::ANALYZER_IPTUNNEL) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IP, 41, PacketAnalyzer::ANALYZER_IPTUNNEL) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IP, 47, PacketAnalyzer::ANALYZER_GRE) +0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IP, 58, PacketAnalyzer::ANALYZER_ICMP) +0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_IP, 6, PacketAnalyzer::ANALYZER_TCP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_LINUXSLL, 2048, PacketAnalyzer::ANALYZER_IP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_LINUXSLL, 2054, PacketAnalyzer::ANALYZER_ARP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_LINUXSLL, 32821, PacketAnalyzer::ANALYZER_ARP) @@ -1641,7 +1681,10 @@ 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 34525, PacketAnalyzer::ANALYZER_IP) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 34887, PacketAnalyzer::ANALYZER_MPLS) 0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VLAN, 34916, PacketAnalyzer::ANALYZER_PPPOE) -0.000000 | HookCallFunction PacketFilter::log_policy([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 33024, PacketAnalyzer::ANALYZER_VLAN) +0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 34984, PacketAnalyzer::ANALYZER_VLAN) +0.000000 | HookCallFunction PacketAnalyzer::register_packet_analyzer(PacketAnalyzer::ANALYZER_VNTAG, 37120, PacketAnalyzer::ANALYZER_VLAN) +0.000000 | HookCallFunction PacketFilter::log_policy([ts=XXXXXXXXXX.XXXXXX, node=zeek, filter=ip or not ip, init=T, success=T], PacketFilter::LOG, [name=default, writer=Log::WRITER_ASCII, path=packet_filter, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) 0.000000 | HookCallFunction Pcap::install_pcap_filter(PacketFilter::DefaultPcapFilter) 0.000000 | HookCallFunction Pcap::precompile_pcap_filter(PacketFilter::DefaultPcapFilter, ip or not ip) 0.000000 | HookCallFunction SumStats::register_observe_plugins() @@ -1664,6 +1707,7 @@ 0.000000 | HookDrainEvents 0.000000 | HookLoadFile ../main <...>/main.zeek 0.000000 | HookLoadFile ../plugin <...>/plugin.zeek +0.000000 | HookLoadFile ./CPP-load.bif.zeek <...>/CPP-load.bif.zeek 0.000000 | HookLoadFile ./Zeek_ARP.events.bif.zeek <...>/Zeek_ARP.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_AsciiReader.ascii.bif.zeek <...>/Zeek_AsciiReader.ascii.bif.zeek 0.000000 | HookLoadFile ./Zeek_AsciiWriter.ascii.bif.zeek <...>/Zeek_AsciiWriter.ascii.bif.zeek @@ -1690,6 +1734,7 @@ 0.000000 | HookLoadFile ./Zeek_Finger.events.bif.zeek <...>/Zeek_Finger.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_GSSAPI.events.bif.zeek <...>/Zeek_GSSAPI.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_GTPv1.events.bif.zeek <...>/Zeek_GTPv1.events.bif.zeek +0.000000 | HookLoadFile ./Zeek_Geneve.events.bif.zeek <...>/Zeek_Geneve.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_Gnutella.events.bif.zeek <...>/Zeek_Gnutella.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_HTTP.events.bif.zeek <...>/Zeek_HTTP.events.bif.zeek 0.000000 | HookLoadFile ./Zeek_HTTP.functions.bif.zeek <...>/Zeek_HTTP.functions.bif.zeek @@ -1867,6 +1912,7 @@ 0.000000 | HookLoadFile ./strings.bif.zeek <...>/strings.bif.zeek 0.000000 | HookLoadFile ./sum <...>/sum.zeek 0.000000 | HookLoadFile ./supervisor.bif.zeek <...>/supervisor.bif.zeek +0.000000 | HookLoadFile ./telemetry.bif.zeek <...>/telemetry.bif.zeek 0.000000 | HookLoadFile ./thresholds <...>/thresholds.zeek 0.000000 | HookLoadFile ./top-k.bif.zeek <...>/top-k.bif.zeek 0.000000 | HookLoadFile ./topk <...>/topk.zeek @@ -1898,6 +1944,7 @@ 0.000000 | HookLoadFile base/init-default <...>/init-default.zeek 0.000000 | HookLoadFile base/init-frameworks-and-bifs.zeek <...>/init-frameworks-and-bifs.zeek 0.000000 | HookLoadFile base/packet-protocols <...>/packet-protocols +0.000000 | HookLoadFile base<...>/CPP-load.bif <...>/CPP-load.bif.zeek 0.000000 | HookLoadFile base<...>/Zeek_KRB.types.bif <...>/Zeek_KRB.types.bif.zeek 0.000000 | HookLoadFile base<...>/Zeek_SNMP.types.bif <...>/Zeek_SNMP.types.bif.zeek 0.000000 | HookLoadFile base<...>/active-http <...>/active-http.zeek @@ -1939,6 +1986,7 @@ 0.000000 | HookLoadFile base<...>/hash <...>/hash 0.000000 | HookLoadFile base<...>/hash_hrw <...>/hash_hrw.zeek 0.000000 | HookLoadFile base<...>/http <...>/http +0.000000 | HookLoadFile base<...>/icmp <...>/icmp 0.000000 | HookLoadFile base<...>/ieee802_11 <...>/ieee802_11 0.000000 | HookLoadFile base<...>/ieee802_11_radio <...>/ieee802_11_radio 0.000000 | HookLoadFile base<...>/imap <...>/imap @@ -2003,14 +2051,17 @@ 0.000000 | HookLoadFile base<...>/supervisor <...>/supervisor 0.000000 | HookLoadFile base<...>/supervisor.bif <...>/supervisor.bif.zeek 0.000000 | HookLoadFile base<...>/syslog <...>/syslog +0.000000 | HookLoadFile base<...>/tcp <...>/tcp 0.000000 | HookLoadFile base<...>/thresholds <...>/thresholds.zeek 0.000000 | HookLoadFile base<...>/time <...>/time.zeek 0.000000 | HookLoadFile base<...>/tunnels <...>/tunnels 0.000000 | HookLoadFile base<...>/types.bif <...>/types.bif.zeek +0.000000 | HookLoadFile base<...>/udp <...>/udp 0.000000 | HookLoadFile base<...>/urls <...>/urls.zeek 0.000000 | HookLoadFile base<...>/utils <...>/utils.zeek 0.000000 | HookLoadFile base<...>/version <...>/version.zeek 0.000000 | HookLoadFile base<...>/vlan <...>/vlan +0.000000 | HookLoadFile base<...>/vntag <...>/vntag 0.000000 | HookLoadFile base<...>/weird <...>/weird.zeek 0.000000 | HookLoadFile base<...>/x509 <...>/x509 0.000000 | HookLoadFile base<...>/xmpp <...>/xmpp @@ -2082,18 +2133,18 @@ XXXXXXXXXX.XXXXXX MetaHookPre UpdateNetworkTime(XXXXXXXXXX.XXXXXX) XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX | HookDrainEvents XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Analyzer::__name, , (Analyzer::ANALYZER_HTTP)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(cat, , (Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(fmt, , (-%s, HTTP)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0))) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Accept, ACCEPT, */*)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0))) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Accept, ACCEPT, */*)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_request, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], GET, <...>/CHANGES.bro-aux.txt, <...>/CHANGES.bro-aux.txt, 1.1)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(network_time, , ()) -> @@ -2108,23 +2159,23 @@ XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228 XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive)) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org)) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0))) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_request([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], GET, <...>/CHANGES.bro-aux.txt, <...>/CHANGES.bro-aux.txt, 1.1)) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) -> false XXXXXXXXXX.XXXXXX MetaHookPost UpdateNetworkTime(XXXXXXXXXX.XXXXXX) -> XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Analyzer::__name, , (Analyzer::ANALYZER_HTTP)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(cat, , (Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(fmt, , (-%s, HTTP)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0))) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Accept, ACCEPT, */*)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0))) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Accept, ACCEPT, */*)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_request, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], GET, <...>/CHANGES.bro-aux.txt, <...>/CHANGES.bro-aux.txt, 1.1)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(network_time, , ()) @@ -2139,24 +2190,24 @@ XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228 XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive)) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org)) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0))) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124])) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_request([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], GET, <...>/CHANGES.bro-aux.txt, <...>/CHANGES.bro-aux.txt, 1.1)) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3)) XXXXXXXXXX.XXXXXX MetaHookPre UpdateNetworkTime(XXXXXXXXXX.XXXXXX) XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX | HookCallFunction Analyzer::__name(Analyzer::ANALYZER_HTTP) -XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) XXXXXXXXXX.XXXXXX | HookCallFunction cat(Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80) XXXXXXXXXX.XXXXXX | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp) XXXXXXXXXX.XXXXXX | HookCallFunction fmt(-%s, HTTP) -XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -XXXXXXXXXX.XXXXXX | HookCallFunction http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -XXXXXXXXXX.XXXXXX | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0)) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Accept, ACCEPT, */*) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive) -XXXXXXXXXX.XXXXXX | HookCallFunction http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]) +XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +XXXXXXXXXX.XXXXXX | HookCallFunction http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=0, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +XXXXXXXXXX.XXXXXX | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=, origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0)) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Accept, ACCEPT, */*) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive) +XXXXXXXXXX.XXXXXX | HookCallFunction http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]) XXXXXXXXXX.XXXXXX | HookCallFunction http_request([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], GET, <...>/CHANGES.bro-aux.txt, <...>/CHANGES.bro-aux.txt, 1.1) XXXXXXXXXX.XXXXXX | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]) XXXXXXXXXX.XXXXXX | HookCallFunction network_time() @@ -2171,7 +2222,7 @@ XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Connection, CONNECTION, Keep-Alive) XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, Host, HOST, bro.org) XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, User-Agent, USER-AGENT, Wget/1.14 (darwin12.2.0)) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={HTTP}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=0, content_gap_length=0, header_length=124]) XXXXXXXXXX.XXXXXX | HookQueueEvent http_request([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], GET, <...>/CHANGES.bro-aux.txt, <...>/CHANGES.bro-aux.txt, 1.1) XXXXXXXXXX.XXXXXX | HookQueueEvent protocol_confirmation([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=70.0 msecs 183.038712 usecs, service={}, history=ShAD, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], Analyzer::ANALYZER_HTTP, 3) XXXXXXXXXX.XXXXXX MetaHookPost DrainEvents() -> @@ -2182,115 +2233,115 @@ XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX | HookDrainEvents XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::__enable_reassembly, , (FMnxxt3xjVcWNS2141)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::__set_reassembly_buffer, , (FMnxxt3xjVcWNS2141, 524288)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(cat, , (Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_new, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_over_new_connection, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_new, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_over_new_connection, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0")) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora))) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_reply, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0")) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora))) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_reply, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTPXXXXXXXXXX.XXXXXXF11141.142.228.5:59856 > 192.150.187.43:80)) -> XXXXXXXXXX.XXXXXX MetaHookPost DrainEvents() -> -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0")) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora))) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_reply([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0")) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora))) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_reply([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) -> false XXXXXXXXXX.XXXXXX MetaHookPost UpdateNetworkTime(XXXXXXXXXX.XXXXXX) -> XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::__enable_reassembly, , (FMnxxt3xjVcWNS2141)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::__set_reassembly_buffer, , (FMnxxt3xjVcWNS2141, 524288)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(cat, , (Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_new, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_over_new_connection, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_new, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_over_new_connection, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0")) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora))) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_reply, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_begin_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0")) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_header, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora))) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_reply, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTPXXXXXXXXXX.XXXXXXF11141.142.228.5:59856 > 192.150.187.43:80)) XXXXXXXXXX.XXXXXX MetaHookPre DrainEvents() -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0")) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora))) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_reply([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=])) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0")) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora))) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_reply([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK)) XXXXXXXXXX.XXXXXX MetaHookPre UpdateNetworkTime(XXXXXXXXXX.XXXXXX) XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX | HookCallFunction Files::__enable_reassembly(FMnxxt3xjVcWNS2141) XXXXXXXXXX.XXXXXX | HookCallFunction Files::__set_reassembly_buffer(FMnxxt3xjVcWNS2141, 524288) -XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) XXXXXXXXXX.XXXXXX | HookCallFunction cat(Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80) -XXXXXXXXXX.XXXXXX | HookCallFunction file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=]) -XXXXXXXXXX.XXXXXX | HookCallFunction file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookCallFunction file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=]) +XXXXXXXXXX.XXXXXX | HookCallFunction file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) XXXXXXXXXX.XXXXXX | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp) -XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookCallFunction http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0") -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT) -XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora)) -XXXXXXXXXX.XXXXXX | HookCallFunction http_reply([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK) +XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookCallFunction http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0") +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT) +XXXXXXXXXX.XXXXXX | HookCallFunction http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora)) +XXXXXXXXXX.XXXXXX | HookCallFunction http_reply([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK) XXXXXXXXXX.XXXXXX | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]) XXXXXXXXXX.XXXXXX | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTPXXXXXXXXXX.XXXXXXF11141.142.228.5:59856 > 192.150.187.43:80) XXXXXXXXXX.XXXXXX | HookDrainEvents -XXXXXXXXXX.XXXXXX | HookQueueEvent file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=]) -XXXXXXXXXX.XXXXXX | HookQueueEvent file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0") -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora)) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_reply([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK) +XXXXXXXXXX.XXXXXX | HookQueueEvent file_new([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=]) +XXXXXXXXXX.XXXXXX | HookQueueEvent file_over_new_connection([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={}, rx_hosts={}, conn_uids={}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=], [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_begin_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Accept-Ranges, ACCEPT-RANGES, bytes) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Connection, CONNECTION, Keep-Alive) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Length, CONTENT-LENGTH, 4705) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Content-Type, CONTENT-TYPE, text/plain; charset=UTF-8) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Date, DATE, Thu, 07 Mar 2013 21:43:07 GMT) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, ETag, ETAG, "1261-4c870358a6fc0") +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Keep-Alive, KEEP-ALIVE, timeout=5, max=100) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Last-Modified, LAST-MODIFIED, Wed, 29 Aug 2012 23:49:27 GMT) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_header([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, Server, SERVER, Apache/2.4.3 (Fedora)) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_reply([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=, status_msg=, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=, resp_filenames=, resp_mime_types=, current_entity=, orig_mime_depth=1, resp_mime_depth=0]}, current_request=1, current_response=0, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], 1.1, 200, OK) XXXXXXXXXX.XXXXXX MetaHookPost DrainEvents() -> XXXXXXXXXX.XXXXXX MetaHookPost UpdateNetworkTime(XXXXXXXXXX.XXXXXX) -> XXXXXXXXXX.XXXXXX MetaHookPre DrainEvents() @@ -2303,18 +2354,18 @@ XXXXXXXXXX.XXXXXX MetaHookPre DrainEvents() XXXXXXXXXX.XXXXXX MetaHookPre UpdateNetworkTime(XXXXXXXXXX.XXXXXX) XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX | HookDrainEvents -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Files::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::__write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::__write, , (HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(cat, , (Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_sniff, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_state_remove, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_sniff, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(file_state_remove, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTPXXXXXXXXXX.XXXXXXF11141.142.228.5:59856 > 192.150.187.43:80)) -> XXXXXXXXXX.XXXXXX MetaHookPost DrainEvents() -> @@ -2322,24 +2373,24 @@ XXXXXXXXXX.XXXXXX MetaHookPost LogInit(Log::WRITER_ASCII, default, true, true XXXXXXXXXX.XXXXXX MetaHookPost LogInit(Log::WRITER_ASCII, default, true, true, http(XXXXXXXXXX.XXXXXX,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}) -> XXXXXXXXXX.XXXXXX MetaHookPost LogWrite(Log::WRITER_ASCII, default, files(XXXXXXXXXX.XXXXXX,0.0,0.0), 25, {ts (time), fuid (string), tx_hosts (set[addr]), rx_hosts (set[addr]), conn_uids (set[string]), source (string), depth (count), analyzers (set[string]), mime_type (string), filename (string), duration (interval), local_orig (bool), is_orig (bool), seen_bytes (count), total_bytes (count), missing_bytes (count), overflow_bytes (count), timedout (bool), parent_fuid (string), md5 (string), sha1 (string), sha256 (string), extracted (string), extracted_cutoff (bool), extracted_size (count)}, ) -> true XXXXXXXXXX.XXXXXX MetaHookPost LogWrite(Log::WRITER_ASCII, default, http(XXXXXXXXXX.XXXXXX,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}, ) -> true -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) -> false XXXXXXXXXX.XXXXXX MetaHookPost UpdateNetworkTime(XXXXXXXXXX.XXXXXX) -> -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Files::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::__write, , (Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::__write, , (HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(cat, , (Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_sniff, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_state_remove, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_sniff, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(file_state_remove, , ([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_end_entity, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(http_message_done, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(set_file_handle, , (Analyzer::ANALYZER_HTTPXXXXXXXXXX.XXXXXXF11141.142.228.5:59856 > 192.150.187.43:80)) XXXXXXXXXX.XXXXXX MetaHookPre DrainEvents() @@ -2347,25 +2398,25 @@ XXXXXXXXXX.XXXXXX MetaHookPre LogInit(Log::WRITER_ASCII, default, true, true XXXXXXXXXX.XXXXXX MetaHookPre LogInit(Log::WRITER_ASCII, default, true, true, http(XXXXXXXXXX.XXXXXX,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}) XXXXXXXXXX.XXXXXX MetaHookPre LogWrite(Log::WRITER_ASCII, default, files(XXXXXXXXXX.XXXXXX,0.0,0.0), 25, {ts (time), fuid (string), tx_hosts (set[addr]), rx_hosts (set[addr]), conn_uids (set[string]), source (string), depth (count), analyzers (set[string]), mime_type (string), filename (string), duration (interval), local_orig (bool), is_orig (bool), seen_bytes (count), total_bytes (count), missing_bytes (count), overflow_bytes (count), timedout (bool), parent_fuid (string), md5 (string), sha1 (string), sha256 (string), extracted (string), extracted_cutoff (bool), extracted_size (count)}, ) XXXXXXXXXX.XXXXXX MetaHookPre LogWrite(Log::WRITER_ASCII, default, http(XXXXXXXXXX.XXXXXX,0.0,0.0), 30, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])}, ) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T])) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=])) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280])) XXXXXXXXXX.XXXXXX MetaHookPre UpdateNetworkTime(XXXXXXXXXX.XXXXXX) XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX -XXXXXXXXXX.XXXXXX | HookCallFunction Files::log_policy([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::log_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +XXXXXXXXXX.XXXXXX | HookCallFunction Files::log_policy([ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], Files::LOG, [name=default, writer=Log::WRITER_ASCII, path=files, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::log_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], HTTP::LOG, [name=default, writer=Log::WRITER_ASCII, path=http, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) XXXXXXXXXX.XXXXXX | HookCallFunction Log::__write(Files::LOG, [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]) XXXXXXXXXX.XXXXXX | HookCallFunction Log::__write(HTTP::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]) XXXXXXXXXX.XXXXXX | HookCallFunction cat(Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, F, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80) -XXXXXXXXXX.XXXXXX | HookCallFunction file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T]) -XXXXXXXXXX.XXXXXX | HookCallFunction file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) +XXXXXXXXXX.XXXXXX | HookCallFunction file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T]) +XXXXXXXXXX.XXXXXX | HookCallFunction file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) XXXXXXXXXX.XXXXXX | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp) -XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookCallFunction http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) +XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookCallFunction http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookCallFunction http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) XXXXXXXXXX.XXXXXX | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]) XXXXXXXXXX.XXXXXX | HookCallFunction set_file_handle(Analyzer::ANALYZER_HTTPXXXXXXXXXX.XXXXXXF11141.142.228.5:59856 > 192.150.187.43:80) XXXXXXXXXX.XXXXXX | HookDrainEvents @@ -2373,11 +2424,11 @@ XXXXXXXXXX.XXXXXX | HookLogInit files 1/1 {ts (time), fuid (string), tx_hosts XXXXXXXXXX.XXXXXX | HookLogInit http 1/1 {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), trans_depth (count), method (string), host (string), uri (string), referrer (string), version (string), user_agent (string), origin (string), request_body_len (count), response_body_len (count), status_code (count), status_msg (string), info_code (count), info_msg (string), tags (set[enum]), username (string), password (string), proxied (set[string]), orig_fuids (vector[string]), orig_filenames (vector[string]), orig_mime_types (vector[string]), resp_fuids (vector[string]), resp_filenames (vector[string]), resp_mime_types (vector[string])} XXXXXXXXXX.XXXXXX | HookLogWrite files [ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts=192.150.187.43, rx_hosts=141.142.228.5, conn_uids=CHhAvVGS1DHFjwGM9, source=HTTP, depth=0, analyzers=, mime_type=text/plain, filename=, duration=0.000263, local_orig=, is_orig=F, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, extracted=, extracted_cutoff=, extracted_size=] XXXXXXXXXX.XXXXXX | HookLogWrite http [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags=, username=, password=, proxied=, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=FMnxxt3xjVcWNS2141, resp_filenames=, resp_mime_types=text/plain] -XXXXXXXXXX.XXXXXX | HookQueueEvent file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T]) -XXXXXXXXXX.XXXXXX | HookQueueEvent file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) -XXXXXXXXXX.XXXXXX | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) -XXXXXXXXXX.XXXXXX | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) +XXXXXXXXXX.XXXXXX | HookQueueEvent file_sniff([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=, current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=], [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T]) +XXXXXXXXXX.XXXXXX | HookQueueEvent file_state_remove([id=FMnxxt3xjVcWNS2141, parent_id=, source=HTTP, is_orig=F, conns={[[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]] = [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=1448, state=4, num_pkts=2, num_bytes_ip=112, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 167.951584 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4705, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0a0.26 | 2012-08-24 15:10:04 -0700\x0a\x0a * Fixing update-changes, which could pick the wrong control file. (Robin Sommer)\x0a\x0a * Fixing GPG signing script. (Robin Sommer)\x0a\x0a0.25 | 2012-08-01 13:55:46 -0500\x0a\x0a * Fix configure script to exit with non-zero status on error (Jon Siwek)\x0a\x0a0.24 | 2012-07-05 12:50:43 -0700\x0a\x0a * Raise minimum required CMake version to 2.6.3 (Jon Siwek)\x0a\x0a * Adding script to delete old fully-merged branches. (Robin Sommer)\x0a\x0a0.23-2 | 2012-01-25 13:24:01 -0800\x0a\x0a * Fix a bro-cut error message. (Daniel Thayer)\x0a\x0a0.23 | 2012-01-11 12:16:11 -0800\x0a\x0a * Tweaks to release scripts, plus a new one for signing files.\x0a (Robin Sommer)\x0a\x0a0.22 | 2012-01-10 16:45:19 -0800\x0a\x0a * Tweaks for OpenBSD support. (Jon Siwek)\x0a\x0a * bro-cut extensions and fixes. (Robin Sommer)\x0a \x0a - If no field names are given on the command line, we now pass through\x0a all fields. Adresses #657.\x0a\x0a - Removing some GNUism from awk script. Addresses #653.\x0a\x0a - Added option for time output in UTC. Addresses #668.\x0a\x0a - Added output field separator option -F. Addresses #649.\x0a\x0a - Fixing option -c: only some header lines were passed through\x0a rather than all. (Robin Sommer)\x0a\x0a * Fix parallel make portability. (Jon Siwek)\x0a\x0a0.21-9 | 2011-11-07 05:44:14 -0800\x0a\x0a * Fixing compiler warnings. Addresses #388. (Jon Siwek)\x0a\x0a0.21-2 | 2011-11-02 18:12:13 -0700\x0a\x0a * Fix for misnaming temp file in update-changes script. (Robin Sommer)\x0a\x0a0.21-1 | 2011-11-02 18:10:39 -0700\x0a\x0a * Little fix for make-release script, which could pick out the wrong\x0a tag. (Robin Sommer)\x0a\x0a0.21 | 2011-10-27 17:40:45 -0700\x0a\x0a * Fixing bro-cut's usage message and argument error handling. (Robin Sommer)\x0a\x0a * Bugfix in update-changes script. (Robin Sommer)\x0a\x0a * update-changes now ignores commits it did itself. (Robin Sommer)\x0a\x0a * Fix a bug in the update-changes script. (Robin Sommer)\x0a\x0a * bro-cut now always installs to $prefix/bin by `make install`. (Jon Siwek)\x0a\x0a * Options to adjust time format for bro-cut. (Robin Sommer)\x0a\x0a The default with -d is now ISO format. The new option "-D "\x0a specifies a custom strftime()-style format string. Alternatively,\x0a the environment variable BRO_CUT_TIMEFMT can set the format as\x0a well.\x0a\x0a * bro-cut now understands the field separator header. (Robin Sommer)\x0a\x0a * Renaming options -h/-H -> -c/-C, and doing some general cleanup.\x0a\x0a0.2 | 2011-10-25 19:53:57 -0700\x0a\x0a * Adding support for replacing version string in a setup.py. (Robin\x0a Sommer)\x0a\x0a * Change generated root cert DN indices format for RFC2253\x0a compliance. (Jon Siwek)\x0a\x0a * New tool devel-tools/check-release to run before making releases.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes gets a new option -a to amend to\x0a previous commit if possible. Default is now not to (used to be the\x0a opposite). (Robin Sommer)\x0a\x0a * Change Mozilla trust root generation to index certs by subject DN. (Jon Siwek)\x0a\x0a * Change distclean to only remove build dir. (Jon Siwek)\x0a\x0a * Make dist now cleans the copied source (Jon Siwek)\x0a\x0a * Small tweak to make-release for forced git-clean. (Jon Siwek)\x0a\x0a * Fix to not let updates scripts loose their executable permissions.\x0a (Robin Sommer)\x0a\x0a * devel-tools/update-changes now looks for a 'release' tag to\x0a idenfify the stable version, and 'beta' for the beta versions.\x0a (Robin Sommer).\x0a\x0a * Distribution cleanup. (Robin Sommer)\x0a\x0a * New script devel-tools/make-release to create source tar balls.\x0a (Robin Sommer)\x0a\x0a * Removing bdcat. With the new log format, this isn't very useful\x0a anymore. (Robin Sommer)\x0a\x0a * Adding script that shows all pending git fastpath commits. (Robin\x0a Sommer)\x0a\x0a * Script to measure CPU time by loading an increasing set of\x0a scripts. (Robin Sommer)\x0a\x0a * extract-conn script now deals wit *.gz files. (Robin Sommer)\x0a\x0a * Tiny update to output a valid CA list file for SSL cert\x0a validation. (Seth Hall)\x0a\x0a * Adding "install-aux" target. Addresses #622. (Jon Siwek)\x0a\x0a * Distribution cleanup. (Jon Siwek and Robin Sommer)\x0a\x0a * FindPCAP now links against thread library when necessary (e.g.\x0a PF_RING's libpcap) (Jon Siwek)\x0a\x0a * Install binaries with an RPATH (Jon Siwek)\x0a\x0a * Workaround for FreeBSD CMake port missing debug flags (Jon Siwek)\x0a\x0a * Rewrite of the update-changes script. (Robin Sommer)\x0a\x0a0.1-1 | 2011-06-14 21:12:41 -0700\x0a\x0a * Add a script for generating Mozilla's CA list for the SSL analyzer.\x0a (Seth Hall)\x0a\x0a0.1 | 2011-04-01 16:28:22 -0700\x0a\x0a * Converting build process to CMake. (Jon Siwek)\x0a\x0a * Removing cf<...>/ca-* from distribution. The README has a note where\x0a to find them now. (Robin Sommer)\x0a\x0a * General cleanup. (Robin Sommer)\x0a\x0a * Initial import of bro/aux from SVN r7088. (Jon Siwek)\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FMnxxt3xjVcWNS2141, tx_hosts={192.150.187.43}, rx_hosts={141.142.228.5}, conn_uids={CHhAvVGS1DHFjwGM9}, source=HTTP, depth=0, analyzers={}, mime_type=text/plain, filename=, duration=262.975693 usecs, local_orig=, is_orig=F, seen_bytes=4042, total_bytes=4705, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], irc=, pe=]) +XXXXXXXXXX.XXXXXX | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_end_entity([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=[filename=], orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F) +XXXXXXXXXX.XXXXXX | HookQueueEvent http_message_done([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=4, num_pkts=3, num_bytes_ip=304, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=4, num_pkts=5, num_bytes_ip=4612, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=140.0 msecs 430.927277 usecs, service={HTTP}, history=ShADad, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={[1] = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=0, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1]}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], F, [start=XXXXXXXXXX.XXXXXX, interrupted=F, finish_msg=message ends normally, body_length=4705, content_gap_length=0, header_length=280]) XXXXXXXXXX.XXXXXX MetaHookPost DrainEvents() -> XXXXXXXXXX.XXXXXX MetaHookPost UpdateNetworkTime(XXXXXXXXXX.XXXXXX) -> XXXXXXXXXX.XXXXXX MetaHookPre DrainEvents() @@ -2405,15 +2456,15 @@ XXXXXXXXXX.XXXXXX | HookDrainEvents XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Broker::__flush_logs, , ()) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Broker::log_flush, , ()) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(ChecksumOffloading::check, , ()) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Conn::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::finalize_http, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Conn::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::finalize_http, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(Log::__write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(cat, , (Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(filter_change_tracking, , ()) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) -> -XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> +XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_net_stats, , ()) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(get_port_transport_proto, , (80/tcp)) -> XXXXXXXXXX.XXXXXX MetaHookPost CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) -> @@ -2428,23 +2479,23 @@ XXXXXXXXXX.XXXXXX MetaHookPost LogInit(Log::WRITER_ASCII, default, true, true XXXXXXXXXX.XXXXXX MetaHookPost LogWrite(Log::WRITER_ASCII, default, conn(XXXXXXXXXX.XXXXXX,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}, ) -> true XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(Broker::log_flush()) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(ChecksumOffloading::check()) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(filter_change_tracking()) -> false -XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false +XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) -> false XXXXXXXXXX.XXXXXX MetaHookPost QueueEvent(zeek_done()) -> false XXXXXXXXXX.XXXXXX MetaHookPost UpdateNetworkTime(XXXXXXXXXX.XXXXXX) -> XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Broker::__flush_logs, , ()) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Broker::log_flush, , ()) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(ChecksumOffloading::check, , ()) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Conn::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::finalize_http, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Conn::log_policy, , ([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::finalize_http, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(HTTP::get_file_handle, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(Log::__write, , (Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(cat, , (Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(connection_state_remove, , ([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(filter_change_tracking, , ()) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(fmt, , (%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp)) -XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_file_handle, , (Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_net_stats, , ()) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(get_port_transport_proto, , (80/tcp)) XXXXXXXXXX.XXXXXX MetaHookPre CallFunction(id_string, , ([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp])) @@ -2459,24 +2510,24 @@ XXXXXXXXXX.XXXXXX MetaHookPre LogInit(Log::WRITER_ASCII, default, true, true XXXXXXXXXX.XXXXXX MetaHookPre LogWrite(Log::WRITER_ASCII, default, conn(XXXXXXXXXX.XXXXXX,0.0,0.0), 21, {ts (time), uid (string), id.orig_h (addr), id.orig_p (port), id.resp_h (addr), id.resp_p (port), proto (enum), service (string), duration (interval), orig_bytes (count), resp_bytes (count), conn_state (string), local_orig (bool), local_resp (bool), missed_bytes (count), history (string), orig_pkts (count), orig_ip_bytes (count), resp_pkts (count), resp_ip_bytes (count), tunnel_parents (set[string])}, ) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(Broker::log_flush()) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(ChecksumOffloading::check()) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=])) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(filter_change_tracking()) -XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) +XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T)) XXXXXXXXXX.XXXXXX MetaHookPre QueueEvent(zeek_done()) XXXXXXXXXX.XXXXXX MetaHookPre UpdateNetworkTime(XXXXXXXXXX.XXXXXX) XXXXXXXXXX.XXXXXX | HookUpdateNetworkTime XXXXXXXXXX.XXXXXX XXXXXXXXXX.XXXXXX | HookCallFunction Broker::__flush_logs() XXXXXXXXXX.XXXXXX | HookCallFunction Broker::log_flush() XXXXXXXXXX.XXXXXX | HookCallFunction ChecksumOffloading::check() -XXXXXXXXXX.XXXXXX | HookCallFunction Conn::log_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, pred=, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) -XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::finalize_http([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) -XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +XXXXXXXXXX.XXXXXX | HookCallFunction Conn::log_policy([ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], Conn::LOG, [name=default, writer=Log::WRITER_ASCII, path=conn, path_func=, include=, exclude=, log_local=T, log_remote=T, field_name_map={}, scope_sep=., ext_prefix=_, ext_func=lambda_<2528247166937952945>, interv=0 secs, postprocessor=, config={}, policy=]) +XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::finalize_http([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=], extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +XXXXXXXXXX.XXXXXX | HookCallFunction HTTP::get_file_handle([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) XXXXXXXXXX.XXXXXX | HookCallFunction Log::__write(Conn::LOG, [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], proto=tcp, service=http, duration=211.0 msecs 483.955383 usecs, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=]) XXXXXXXXXX.XXXXXX | HookCallFunction cat(Analyzer::ANALYZER_HTTP, XXXXXXXXXX.XXXXXX, T, 1, 1, 141.142.228.5:59856 > 192.150.187.43:80) -XXXXXXXXXX.XXXXXX | HookCallFunction connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +XXXXXXXXXX.XXXXXX | HookCallFunction connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) XXXXXXXXXX.XXXXXX | HookCallFunction filter_change_tracking() XXXXXXXXXX.XXXXXX | HookCallFunction fmt(%s:%d > %s:%d, 141.142.228.5, 59856/tcp, 192.150.187.43, 80/tcp) -XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +XXXXXXXXXX.XXXXXX | HookCallFunction get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) XXXXXXXXXX.XXXXXX | HookCallFunction get_net_stats() XXXXXXXXXX.XXXXXX | HookCallFunction get_port_transport_proto(80/tcp) XXXXXXXXXX.XXXXXX | HookCallFunction id_string([orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp]) @@ -2491,7 +2542,7 @@ XXXXXXXXXX.XXXXXX | HookLogInit conn 1/1 {ts (time), uid (string), id.orig_h ( XXXXXXXXXX.XXXXXX | HookLogWrite conn [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id.orig_h=141.142.228.5, id.orig_p=59856, id.resp_h=192.150.187.43, id.resp_p=80, proto=tcp, service=http, duration=0.211484, orig_bytes=136, resp_bytes=5007, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShADadFf, orig_pkts=7, orig_ip_bytes=512, resp_pkts=7, resp_ip_bytes=5379, tunnel_parents=] XXXXXXXXXX.XXXXXX | HookQueueEvent Broker::log_flush() XXXXXXXXXX.XXXXXX | HookQueueEvent ChecksumOffloading::check() -XXXXXXXXXX.XXXXXX | HookQueueEvent connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) +XXXXXXXXXX.XXXXXX | HookQueueEvent connection_state_remove([id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]) XXXXXXXXXX.XXXXXX | HookQueueEvent filter_change_tracking() -XXXXXXXXXX.XXXXXX | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, HTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) +XXXXXXXXXX.XXXXXX | HookQueueEvent get_file_handle(Analyzer::ANALYZER_HTTP, [id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], orig=[size=136, state=5, num_pkts=7, num_bytes_ip=512, flow_label=0, l2_addr=c8:bc:c8:96:d2:a0], resp=[size=5007, state=5, num_pkts=7, num_bytes_ip=5379, flow_label=0, l2_addr=00:10:db:88:d2:ef], start_time=XXXXXXXXXX.XXXXXX, duration=211.0 msecs 483.955383 usecs, service={HTTP}, history=ShADadFf, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={HTTP::finalize_http{ HTTP::r, HTTP::info{ if (HTTP::c?$http_state) { for ([HTTP::r] in HTTP::c$http_state$pending) { if (0 == HTTP::r) next inline(HTTP::LOG, to_any_coerceHTTP::info){{ return (Log::__write(Log::id, Log::columns))}}}}}}}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=141.142.228.5, orig_p=59856/tcp, resp_h=192.150.187.43, resp_p=80/tcp], trans_depth=1, method=GET, host=bro.org, uri=<...>/CHANGES.bro-aux.txt, referrer=, version=1.1, user_agent=Wget/1.14 (darwin12.2.0), origin=, request_body_len=0, response_body_len=4705, status_code=200, status_msg=OK, info_code=, info_msg=, tags={}, username=, password=, capture_password=F, proxied=, range_request=F, orig_fuids=, orig_filenames=, orig_mime_types=, resp_fuids=[FMnxxt3xjVcWNS2141], resp_filenames=, resp_mime_types=[text/plain], current_entity=, orig_mime_depth=1, resp_mime_depth=1], http_state=[pending={}, current_request=1, current_response=1, trans_depth=1], irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=], T) XXXXXXXXXX.XXXXXX | HookQueueEvent zeek_done() diff --git a/testing/btest/Baseline.inline/scripts.base.frameworks.file-analysis.bifs.file_exists_lookup_file/.stdout b/testing/btest/Baseline.inline/scripts.base.frameworks.file-analysis.bifs.file_exists_lookup_file/.stdout index ef1db7d017..ccf66e3400 100644 --- a/testing/btest/Baseline.inline/scripts.base.frameworks.file-analysis.bifs.file_exists_lookup_file/.stdout +++ b/testing/btest/Baseline.inline/scripts.base.frameworks.file-analysis.bifs.file_exists_lookup_file/.stdout @@ -1,5 +1,4 @@ ### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. -error: file ID asdf not a known file This should fail but not crash This should return F F diff --git a/testing/btest/Baseline.inline/scripts.base.frameworks.file-analysis.bifs.file_exists_lookup_file/err b/testing/btest/Baseline.inline/scripts.base.frameworks.file-analysis.bifs.file_exists_lookup_file/err new file mode 100644 index 0000000000..ee509ce372 --- /dev/null +++ b/testing/btest/Baseline.inline/scripts.base.frameworks.file-analysis.bifs.file_exists_lookup_file/err @@ -0,0 +1,2 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +error: file ID asdf not a known file diff --git a/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/all-events-no-args.log b/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/all-events-no-args.log index 736708d269..87f9a35705 100644 --- a/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/all-events-no-args.log +++ b/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/all-events-no-args.log @@ -1,236 +1,237 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. 0.000000 zeek_init 0.000000 NetControl::init 0.000000 filter_change_tracking -1254722767.492060 Broker::log_flush -1254722767.492060 ChecksumOffloading::check -1254722767.492060 filter_change_tracking -1254722767.492060 new_connection -1254722767.492060 dns_message -1254722767.492060 dns_request -1254722767.492060 protocol_confirmation -1254722767.492060 dns_end -1254722767.526085 dns_message -1254722767.526085 dns_CNAME_reply -1254722767.526085 dns_A_reply -1254722767.526085 dns_end -1254722767.529046 new_connection -1254722767.875996 connection_established -1254722768.219663 smtp_reply -1254722768.219663 smtp_reply -1254722768.219663 smtp_reply -1254722768.224809 protocol_confirmation -1254722768.224809 smtp_request -1254722768.565386 Broker::log_flush -1254722768.566183 smtp_reply -1254722768.566183 smtp_reply -1254722768.566183 smtp_reply -1254722768.566183 smtp_reply -1254722768.566183 smtp_reply -1254722768.566183 smtp_reply -1254722768.568729 smtp_request -1254722768.911081 smtp_reply -1254722768.911655 smtp_request -1254722769.253544 smtp_reply -1254722769.254118 smtp_request -1254722769.613798 Broker::log_flush -1254722769.613798 smtp_reply -1254722769.614414 smtp_request -1254722769.956765 smtp_reply -1254722769.957250 smtp_request -1254722770.319708 smtp_reply -1254722770.320203 smtp_request -1254722770.320203 mime_begin_entity -1254722770.661679 Broker::log_flush -1254722770.661679 smtp_reply -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 mime_begin_entity -1254722770.692743 mime_one_header -1254722770.692743 mime_begin_entity -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 get_file_handle -1254722770.692743 file_new -1254722770.692743 file_over_new_connection -1254722770.692743 mime_end_entity -1254722770.692743 get_file_handle -1254722770.692743 file_sniff -1254722770.692743 file_state_remove -1254722770.692743 get_file_handle -1254722770.692743 mime_begin_entity -1254722770.692743 mime_one_header -1254722770.692743 mime_one_header -1254722770.692743 get_file_handle -1254722770.692743 file_new -1254722770.692743 file_over_new_connection -1254722770.692804 mime_end_entity -1254722770.692804 get_file_handle -1254722770.692804 file_sniff -1254722770.692804 file_state_remove -1254722770.692804 get_file_handle -1254722770.692804 mime_end_entity -1254722770.692804 get_file_handle -1254722770.692804 get_file_handle -1254722770.692804 mime_begin_entity -1254722770.692804 mime_one_header -1254722770.692804 mime_one_header -1254722770.692804 mime_one_header -1254722770.692804 get_file_handle -1254722770.692804 file_new -1254722770.692804 file_over_new_connection -1254722770.695115 new_connection -1254722771.494181 file_sniff -1254722771.834595 Broker::log_flush -1254722771.858334 mime_end_entity -1254722771.858334 get_file_handle -1254722771.858334 file_state_remove -1254722771.858334 get_file_handle -1254722771.858334 mime_end_entity -1254722771.858334 get_file_handle -1254722771.858334 get_file_handle -1254722771.858334 get_file_handle -1254722771.858334 get_file_handle -1254722771.858334 smtp_request -1254722772.248789 smtp_reply -1254722774.763825 Broker::log_flush -1254722774.763825 smtp_request -1254722775.105467 smtp_reply -1254722776.690444 Broker::log_flush -1254722776.690444 new_connection -1437831776.764391 ChecksumOffloading::check -1437831776.764391 connection_state_remove -1437831776.764391 Broker::log_flush -1437831776.764391 connection_state_remove -1437831776.764391 connection_state_remove -1437831776.764391 connection_state_remove -1437831776.764391 filter_change_tracking -1437831776.764391 new_connection -1437831787.856895 Broker::log_flush -1437831787.856895 new_connection -1437831787.861602 connection_established -1437831787.867142 smtp_reply -1437831787.883306 protocol_confirmation -1437831787.883306 smtp_request -1437831787.886281 smtp_reply -1437831787.886281 smtp_reply -1437831787.886281 smtp_reply -1437831787.886281 smtp_reply -1437831787.887031 smtp_request -1437831787.889785 smtp_reply -1437831787.890232 smtp_request -1437831787.892986 smtp_reply -1437831787.893587 smtp_request -1437831787.897624 smtp_reply -1437831787.898413 smtp_request -1437831787.901069 smtp_reply -1437831787.901697 smtp_request -1437831787.901697 mime_begin_entity -1437831787.904758 smtp_reply -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 mime_one_header -1437831787.905375 get_file_handle -1437831787.905375 file_new -1437831787.905375 file_over_new_connection -1437831787.905375 mime_end_entity -1437831787.905375 get_file_handle -1437831787.905375 file_sniff -1437831787.905375 file_state_remove -1437831787.905375 get_file_handle -1437831787.905375 get_file_handle -1437831787.905375 get_file_handle -1437831787.905375 smtp_request -1437831787.914113 smtp_reply -1437831798.533593 Broker::log_flush -1437831798.533593 new_connection -1437831799.262632 new_connection -1437831799.461152 new_connection -1437831799.610433 Broker::log_flush -1437831799.610433 connection_established -1437831799.611764 ssl_extension_server_name -1437831799.611764 ssl_extension -1437831799.611764 ssl_extension -1437831799.611764 ssl_extension -1437831799.611764 ssl_extension -1437831799.611764 ssl_extension -1437831799.611764 protocol_confirmation -1437831799.611764 ssl_client_hello -1437831799.611764 ssl_handshake_message -1437831799.611764 ssl_plaintext_data -1437831799.764576 ssl_extension -1437831799.764576 ssl_server_hello -1437831799.764576 ssl_handshake_message -1437831799.764576 file_new -1437831799.764576 file_over_new_connection -1437831799.764576 file_sniff -1437831799.764576 file_hash -1437831799.764576 file_hash -1437831799.764576 x509_certificate -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_ext_basic_constraints -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_ext_subject_alternative_name -1437831799.764576 file_hash -1437831799.764576 file_state_remove -1437831799.764576 file_new -1437831799.764576 file_over_new_connection -1437831799.764576 file_sniff -1437831799.764576 file_hash -1437831799.764576 file_hash -1437831799.764576 x509_certificate -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_ext_basic_constraints -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 x509_extension -1437831799.764576 file_hash -1437831799.764576 file_state_remove -1437831799.764576 ssl_handshake_message -1437831799.764576 ssl_handshake_message -1437831799.764576 ssl_plaintext_data -1437831799.838196 ssl_handshake_message -1437831799.838196 ssl_plaintext_data -1437831799.838197 ssl_change_cipher_spec -1437831799.838197 ssl_plaintext_data -1437831800.045701 ssl_change_cipher_spec -1437831800.045701 ssl_plaintext_data -1437831800.045701 ssl_established -1437831800.217854 net_done -1437831800.217854 Broker::log_flush -1437831800.217854 filter_change_tracking -1437831800.217854 connection_state_remove -1437831800.217854 connection_state_remove -1437831800.217854 connection_state_remove -1437831800.217854 connection_state_remove -1437831800.217854 connection_state_remove -1437831800.217854 zeek_done -1437831800.217854 ChecksumOffloading::check +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX ChecksumOffloading::check +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX dns_message +XXXXXXXXXX.XXXXXX dns_request +XXXXXXXXXX.XXXXXX protocol_confirmation +XXXXXXXXXX.XXXXXX dns_end +XXXXXXXXXX.XXXXXX dns_message +XXXXXXXXXX.XXXXXX dns_CNAME_reply +XXXXXXXXXX.XXXXXX dns_A_reply +XXXXXXXXXX.XXXXXX dns_end +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX connection_established +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX protocol_confirmation +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX mime_begin_entity +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_begin_entity +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_begin_entity +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX file_new +XXXXXXXXXX.XXXXXX file_over_new_connection +XXXXXXXXXX.XXXXXX mime_end_entity +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX file_sniff +XXXXXXXXXX.XXXXXX file_state_remove +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX mime_begin_entity +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX file_new +XXXXXXXXXX.XXXXXX file_over_new_connection +XXXXXXXXXX.XXXXXX mime_end_entity +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX file_sniff +XXXXXXXXXX.XXXXXX file_state_remove +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX mime_end_entity +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX mime_begin_entity +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX file_new +XXXXXXXXXX.XXXXXX file_over_new_connection +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX file_sniff +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX mime_end_entity +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX file_state_remove +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX mime_end_entity +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX ChecksumOffloading::check +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX connection_established +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX protocol_confirmation +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX mime_begin_entity +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX mime_one_header +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX file_new +XXXXXXXXXX.XXXXXX file_over_new_connection +XXXXXXXXXX.XXXXXX mime_end_entity +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX file_sniff +XXXXXXXXXX.XXXXXX file_state_remove +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle +XXXXXXXXXX.XXXXXX smtp_request +XXXXXXXXXX.XXXXXX smtp_reply +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX new_connection +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX connection_established +XXXXXXXXXX.XXXXXX ssl_extension_server_name +XXXXXXXXXX.XXXXXX ssl_extension +XXXXXXXXXX.XXXXXX ssl_extension +XXXXXXXXXX.XXXXXX ssl_extension +XXXXXXXXXX.XXXXXX ssl_extension +XXXXXXXXXX.XXXXXX ssl_extension +XXXXXXXXXX.XXXXXX protocol_confirmation +XXXXXXXXXX.XXXXXX ssl_client_hello +XXXXXXXXXX.XXXXXX ssl_handshake_message +XXXXXXXXXX.XXXXXX ssl_plaintext_data +XXXXXXXXXX.XXXXXX ssl_extension +XXXXXXXXXX.XXXXXX ssl_server_hello +XXXXXXXXXX.XXXXXX ssl_handshake_message +XXXXXXXXXX.XXXXXX file_new +XXXXXXXXXX.XXXXXX file_over_new_connection +XXXXXXXXXX.XXXXXX file_sniff +XXXXXXXXXX.XXXXXX file_hash +XXXXXXXXXX.XXXXXX file_hash +XXXXXXXXXX.XXXXXX x509_certificate +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_ext_basic_constraints +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_ext_subject_alternative_name +XXXXXXXXXX.XXXXXX file_hash +XXXXXXXXXX.XXXXXX file_state_remove +XXXXXXXXXX.XXXXXX file_new +XXXXXXXXXX.XXXXXX file_over_new_connection +XXXXXXXXXX.XXXXXX file_sniff +XXXXXXXXXX.XXXXXX file_hash +XXXXXXXXXX.XXXXXX file_hash +XXXXXXXXXX.XXXXXX x509_certificate +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_ext_basic_constraints +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX x509_extension +XXXXXXXXXX.XXXXXX file_hash +XXXXXXXXXX.XXXXXX file_state_remove +XXXXXXXXXX.XXXXXX ssl_handshake_message +XXXXXXXXXX.XXXXXX ssl_handshake_message +XXXXXXXXXX.XXXXXX ssl_plaintext_data +XXXXXXXXXX.XXXXXX ssl_handshake_message +XXXXXXXXXX.XXXXXX ssl_plaintext_data +XXXXXXXXXX.XXXXXX ssl_change_cipher_spec +XXXXXXXXXX.XXXXXX ssl_plaintext_data +XXXXXXXXXX.XXXXXX ssl_change_cipher_spec +XXXXXXXXXX.XXXXXX ssl_plaintext_data +XXXXXXXXXX.XXXXXX ssl_established +XXXXXXXXXX.XXXXXX net_done +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX connection_state_remove +XXXXXXXXXX.XXXXXX zeek_done +XXXXXXXXXX.XXXXXX ChecksumOffloading::check diff --git a/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/all-events.log b/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/all-events.log index 20306795c5..e3d18a0b72 100644 --- a/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/all-events.log +++ b/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/all-events.log @@ -1,1075 +1,1076 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. 0.000000 zeek_init 0.000000 NetControl::init 0.000000 filter_change_tracking -1254722767.492060 Broker::log_flush -1254722767.492060 ChecksumOffloading::check -1254722767.492060 filter_change_tracking -1254722767.492060 new_connection - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX ChecksumOffloading::check +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.492060 dns_message - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_message + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=F, AA=F, TC=F, RD=T, RA=F, Z=0, num_queries=1, num_answers=0, num_auth=0, num_addl=0] [3] len: count = 34 -1254722767.492060 dns_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=, qclass=, qclass_name=, qtype=, qtype_name=, rcode=, rcode_name=, AA=F, TC=F, RD=F, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=, qclass=, qclass_name=, qtype=, qtype_name=, rcode=, rcode_name=, AA=F, TC=F, RD=F, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=, qclass=, qclass_name=, qtype=, qtype_name=, rcode=, rcode_name=, AA=F, TC=F, RD=F, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=, qclass=, qclass_name=, qtype=, qtype_name=, rcode=, rcode_name=, AA=F, TC=F, RD=F, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=F, AA=F, TC=F, RD=T, RA=F, Z=0, num_queries=1, num_answers=0, num_auth=0, num_addl=0] [2] query: string = mail.patriots.in [3] qtype: count = 1 [4] qclass: count = 1 [5] original_query: string = mail.patriots.in -1254722767.492060 protocol_confirmation - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX protocol_confirmation + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] atype: enum = Analyzer::ANALYZER_DNS [2] aid: count = 3 -1254722767.492060 dns_end - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0aDNS\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_end + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0aDNS\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=F, AA=F, TC=F, RD=T, RA=F, Z=0, num_queries=1, num_answers=0, num_auth=0, num_addl=0] -1254722767.526085 dns_message - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_message + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] [3] len: count = 100 -1254722767.526085 dns_CNAME_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_CNAME_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] [2] ans: dns_answer = [answer_type=1, query=mail.patriots.in, qtype=5, qclass=1, TTL=3.0 hrs 27.0 secs] [3] name: string = patriots.in -1254722767.526085 dns_A_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in], TTLs=[3.0 hrs 27.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_A_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in], TTLs=[3.0 hrs 27.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] [2] ans: dns_answer = [answer_type=1, query=patriots.in, qtype=1, qclass=1, TTL=3.0 hrs 28.0 secs] [3] a: addr = 74.53.140.153 -1254722767.526085 dns_end - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in, 74.53.140.153], TTLs=[3.0 hrs 27.0 secs, 3.0 hrs 28.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_end + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in, 74.53.140.153], TTLs=[3.0 hrs 27.0 secs, 3.0 hrs 28.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] -1254722767.529046 new_connection - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.875996 connection_established - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_established + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 [5] cont_resp: bool = T -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = We do not authorize the use of this system to transport unsolicited, [5] cont_resp: bool = T -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 We do not authorize the use of this system to transport unsolicited, , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 We do not authorize the use of this system to transport unsolicited, , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = and/or bulk e-mail. [5] cont_resp: bool = F -1254722768.224809 protocol_confirmation - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX protocol_confirmation + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] atype: enum = Analyzer::ANALYZER_SMTP [2] aid: count = 7 -1254722768.224809 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=695.0 msecs 762.872696 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=695.0 msecs 762.872696 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = EHLO [3] arg: string = GP -1254722768.565386 Broker::log_flush -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = xc90.websitewelcome.com Hello GP [122.162.143.157] [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 xc90.websitewelcome.com Hello GP [122.162.143.157], path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 xc90.websitewelcome.com Hello GP [122.162.143.157], path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = SIZE 52428800 [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 SIZE 52428800, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 SIZE 52428800, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = PIPELINING [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 PIPELINING, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 PIPELINING, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = AUTH PLAIN LOGIN [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH PLAIN LOGIN, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH PLAIN LOGIN, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = STARTTLS [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 STARTTLS, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 STARTTLS, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = HELP [5] cont_resp: bool = F -1254722768.568729 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = AUTH [3] arg: string = LOGIN -1254722768.911081 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 334 [3] cmd: string = AUTH [4] msg: string = VXNlcm5hbWU6 [5] cont_resp: bool = F -1254722768.911655 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = ** [3] arg: string = Z3VycGFydGFwQHBhdHJpb3RzLmlu -1254722769.253544 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 334 [3] cmd: string = AUTH_ANSWER [4] msg: string = UGFzc3dvcmQ6 [5] cont_resp: bool = F -1254722769.254118 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = ** [3] arg: string = cHVuamFiQDEyMw== -1254722769.613798 Broker::log_flush -1254722769.613798 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 235 [3] cmd: string = AUTH_ANSWER [4] msg: string = Authentication succeeded [5] cont_resp: bool = F -1254722769.614414 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = MAIL [3] arg: string = FROM: -1254722769.956765 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = MAIL [4] msg: string = OK [5] cont_resp: bool = F -1254722769.957250 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1254722770.319708 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Accepted [5] cont_resp: bool = F -1254722770.320203 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = DATA [3] arg: string = -1254722770.320203 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] -1254722770.661679 Broker::log_flush -1254722770.661679 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 354 [3] cmd: string = DATA [4] msg: string = Enter message, ending with "." on a line by itself [5] cont_resp: bool = F -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=From, name=FROM, value="Gurpartap Singh" ] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=To, name=TO, value=] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Subject, name=SUBJECT, value=SMTP] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Date, name=DATE, value=Mon, 5 Oct 2009 11:36:07 +0530] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Message-ID, name=MESSAGE-ID, value=<000301ca4581$ef9e57f0$cedb07d0$@in>] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=MIME-Version, name=MIME-VERSION, value=1.0] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=multipart/mixed;\x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0"] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=X-Mailer, name=X-MAILER, value=Microsoft Office Outlook 12.0] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Thread-Index, name=THREAD-INDEX, value=AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Language, name=CONTENT-LANGUAGE, value=en-us] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=x-cr-hashedpuzzle, name=X-CR-HASHEDPUZZLE, value=SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA=] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=x-cr-puzzleid, name=X-CR-PUZZLEID, value={CAA37F59-1850-45C7-8540-AA27696B5398}] -1254722770.692743 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=multipart/alternative;\x09boundary="----=_NextPart_001_0005_01CA45B0.095693F0"] -1254722770.692743 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain;\x09charset="us-ascii"] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=7bit] -1254722770.692743 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 file_new - [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1254722770.692743 file_over_new_connection - [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1254722770.692743, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] -1254722770.692743 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 file_sniff - [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a, info=[ts=1254722770.692743, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T] -1254722770.692743 file_state_remove - [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a, info=[ts=1254722770.692743, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1254722770.692743 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722770.692743 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=text/html;\x09charset="us-ascii"] -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=quoted-printable] -1254722770.692743 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 file_new - [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1254722770.692743 file_over_new_connection - [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1254722770.692743, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692804 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692804 file_sniff - [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692804, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a, info=[ts=1254722770.692743, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=text/html, mime_types=[[strength=100, mime=text/html], [strength=20, mime=text/html], [strength=-20, mime=text/plain]], inferred=T] -1254722770.692804 file_state_remove - [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692804, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a, info=[ts=1254722770.692743, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=text/html, filename=, duration=61.035156 usecs, local_orig=, is_orig=T, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=text/html, filename=, duration=61.035156 usecs, local_orig=, is_orig=T, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722770.692804 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722770.692804 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] -1254722770.692804 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain;\x09name="NEWS.txt"] -1254722770.692804 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=quoted-printable] -1254722770.692804 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Disposition, name=CONTENT-DISPOSITION, value=attachment;\x09filename="NEWS.txt"] -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692804 file_new - [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692804, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1254722770.692804 file_over_new_connection - [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692804, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1254722770.692804, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.695115 new_connection - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722771.494181 file_sniff - [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=1254722771.494181, seen_bytes=4027, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress , info=[ts=1254722770.692804, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=, filename=NEWS.txt, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4027, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress , info=[ts=XXXXXXXXXX.XXXXXX, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=, filename=NEWS.txt, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T] -1254722771.834595 Broker::log_flush -1254722771.858334 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722771.858334 file_state_remove - [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=1254722771.858316, seen_bytes=10809, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress , info=[ts=1254722770.692804, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=text/plain, filename=NEWS.txt, duration=801.0 msecs 376.819611 usecs, local_orig=, is_orig=T, seen_bytes=4027, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=10809, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress , info=[ts=XXXXXXXXXX.XXXXXX, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=text/plain, filename=NEWS.txt, duration=801.0 msecs 376.819611 usecs, local_orig=, is_orig=T, seen_bytes=4027, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722771.858334 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722771.858334 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = . [3] arg: string = . -1254722772.248789 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = . [4] msg: string = OK id=1Mugho-0003Dg-Un [5] cont_resp: bool = F -1254722774.763825 Broker::log_flush -1254722774.763825 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = QUIT [3] arg: string = -1254722775.105467 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 221 [3] cmd: string = QUIT [4] msg: string = xc90.websitewelcome.com closing connection [5] cont_resp: bool = F -1254722776.690444 Broker::log_flush -1254722776.690444 new_connection - [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=1254722776.690444, duration=0 secs, service={\x0a\x0a}, history=, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 ChecksumOffloading::check -1437831776.764391 connection_state_remove - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=1, num_bytes_ip=128, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ChecksumOffloading::check +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=1, num_bytes_ip=128, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 Broker::log_flush -1437831776.764391 connection_state_remove - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=25, num_bytes_ip=1546, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=25, num_bytes_ip=1546, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] -1437831776.764391 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=2192, state=1, num_pkts=4, num_bytes_ip=2304, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=1.0 msec 518.964767 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=2192, state=1, num_pkts=4, num_bytes_ip=2304, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 msec 518.964767 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 connection_state_remove - [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=1, num_bytes_ip=229, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=1254722776.690444, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=1, num_bytes_ip=229, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 filter_change_tracking -1437831776.764391 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831787.856895 Broker::log_flush -1437831787.856895 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831787.861602 connection_established - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_established + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831787.867142 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = uprise ESMTP SubEthaSMTP null [5] cont_resp: bool = F -1437831787.883306 protocol_confirmation - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX protocol_confirmation + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] atype: enum = Analyzer::ANALYZER_SMTP [2] aid: count = 21 -1437831787.883306 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = EHLO [3] arg: string = [192.168.133.100] -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = uprise [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 uprise, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 uprise, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = 8BITMIME [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 8BITMIME, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 8BITMIME, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = AUTH LOGIN [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH LOGIN, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH LOGIN, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.887031 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = MAIL [3] arg: string = FROM: -1437831787.889785 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = MAIL [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.890232 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.892986 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.893587 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.897624 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.898413 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.901069 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.901697 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = DATA [3] arg: string = -1437831787.901697 mime_begin_entity - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] -1437831787.904758 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 354 [3] cmd: string = DATA [4] msg: string = End data with . [5] cont_resp: bool = F -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain; charset=us-ascii] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Mime-Version, name=MIME-VERSION, value=1.0 (Mac OS X Mail 8.2 \(2102\))] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Subject, name=SUBJECT, value=Re: Bro SMTP CC Header] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=From, name=FROM, value=Albert Zaharovits ] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=In-Reply-To, name=IN-REPLY-TO, value=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Date, name=DATE, value=Sat, 25 Jul 2015 16:43:07 +0300] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Cc, name=CC, value=felica4uu@hotmail.com, davis_mark1@outlook.com] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=7bit] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Message-Id, name=MESSAGE-ID, value=] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=References, name=REFERENCES, value= <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=To, name=TO, value=ericlim220@yahoo.com] -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=X-Mailer, name=X-MAILER, value=Apple Mail (2.2102)] -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = T -1437831787.905375 file_new - [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=1437831787.905375, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1437831787.905375 file_over_new_connection - [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=1437831787.905375, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831787.905375, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = T -1437831787.905375 mime_end_entity - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = T -1437831787.905375 file_sniff - [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=1437831787.905375, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a, info=[ts=1437831787.905375, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T] -1437831787.905375 file_state_remove - [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=1437831787.905375, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a, info=[ts=1437831787.905375, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = F -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = T -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = F -1437831787.905375 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = . [3] arg: string = . -1437831787.914113 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = . [4] msg: string = Ok [5] cont_resp: bool = F -1437831798.533593 Broker::log_flush -1437831798.533593 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.262632 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.461152 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.610433 Broker::log_flush -1437831799.610433 connection_established - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX connection_established + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.611764 ssl_extension_server_name - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension_server_name + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] names: vector of string = [p31-keyvalueservice.icloud.com] -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 0 [3] val: string = \x00!\x00\x00\x1ep31-keyvalueservice.icloud.com -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 10 [3] val: string = \x00\x06\x00\x17\x00\x18\x00\x19 -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 11 [3] val: string = \x01\x00 -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 13 [3] val: string = \x00\x0a\x05\x01\x04\x01\x02\x01\x04\x03\x02\x03 -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 13172 [3] val: string = -1437831799.611764 protocol_confirmation - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX protocol_confirmation + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] atype: enum = Analyzer::ANALYZER_SSL [2] aid: count = 35 -1437831799.611764 ssl_client_hello - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_client_hello + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] version: count = 771 [2] record_version: count = 769 - [3] possible_ts: time = 1437831799.0 + [3] possible_ts: time = XXXXXXXXXX.XXXXXX [4] client_random: string = \xd4\xda\xbe{\xfa\xaa\x16\xb2\xe7\x92\x9d\xbf\xe1c\x97\xde\xdca7\x92\x90\xf6\x967\xf7\xec\x1e\xe6 [5] session_id: string = \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 [6] ciphers: vector of count = [255, 49188, 49187, 49162, 49161, 49160, 49192, 49191, 49172, 49171, 49170, 49190, 49189, 49157, 49156, 49155, 49194, 49193, 49167, 49166, 49165, 107, 103, 57, 51, 22, 61, 60, 53, 47, 10, 49159, 49169, 49154, 49164, 5, 4] [7] comp_methods: vector of count = [0] -1437831799.611764 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] msg_type: count = 1 [3] length: count = 192 -1437831799.611764 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] record_version: count = 769 [3] content_type: count = 22 [4] length: count = 196 -1437831799.764576 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 65281 [3] val: string = \x00 -1437831799.764576 ssl_server_hello - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_server_hello + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] version: count = 771 [2] record_version: count = 771 - [3] possible_ts: time = 1437831799.0 + [3] possible_ts: time = XXXXXXXXXX.XXXXXX [4] server_random: string = U\xb3\x92w\xe2RB\xdds\x11\xa9\xd4\x1d\xbc\x8e\xe2]\x09\xc5\xfc\xb1\xedl\xed\x17\xb2?a\xac\x81QM [5] session_id: string = \x17x\xe5j\x19T\x12vWY\xcf\xf3\xeai\\xdf\x09[]\xb7\xdf.[\x0e\x04\xa8\x89bJ\x94\xa7\x0c [6] cipher: count = 4 [7] comp_method: count = 0 -1437831799.764576 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] msg_type: count = 2 [3] length: count = 77 -1437831799.764576 file_new - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1437831799.764576 file_over_new_connection - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [2] is_orig: bool = F -1437831799.764576 file_sniff - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=application/x-x509-user-cert, mime_types=, inferred=F] -1437831799.764576 file_hash - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = md5 [2] hash: string = 1bf9696d9f337805383427e88781d001 -1437831799.764576 file_hash - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = sha256 [2] hash: string = f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56 -1437831799.764576 x509_certificate - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_certificate + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] cert_ref: opaque of x509 = - [2] cert: X509::Certificate = [version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=] + [2] cert: X509::Certificate = [version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE] -1437831799.764576 x509_ext_basic_constraints - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_ext_basic_constraints + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::BasicConstraints = [ca=F, path_len=] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com] -1437831799.764576 x509_ext_subject_alternative_name - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_ext_subject_alternative_name + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::SubjectAlternativeName = [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F] -1437831799.764576 file_hash - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = sha1 [2] hash: string = f5ccb1a724133607548b00d8eb402efca3076d58 -1437831799.764576 file_state_remove - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1437831799.764576 file_new - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1437831799.764576 file_over_new_connection - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [2] is_orig: bool = F -1437831799.764576 file_sniff - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=application/x-x509-ca-cert, mime_types=, inferred=F] -1437831799.764576 file_hash - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = md5 [2] hash: string = 48f0e38385112eeca5fc9ffd402eaecd -1437831799.764576 file_hash - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = sha256 [2] hash: string = ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b -1437831799.764576 x509_certificate - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_certificate + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] cert_ref: opaque of x509 = - [2] cert: X509::Certificate = [version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=] + [2] cert: X509::Certificate = [version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0] -1437831799.764576 x509_ext_basic_constraints - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_ext_basic_constraints + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::BasicConstraints = [ca=T, path_len=0] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a] -1437831799.764576 file_hash - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = sha1 [2] hash: string = 8e8321ca08b08e3726fe1d82996884eeb5f0d655 -1437831799.764576 file_state_remove - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1437831799.764576 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] msg_type: count = 11 [3] length: count = 2507 -1437831799.764576 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] msg_type: count = 14 [3] length: count = 0 -1437831799.764576 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] record_version: count = 771 [3] content_type: count = 22 [4] length: count = 2596 -1437831799.838196 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] msg_type: count = 16 [3] length: count = 258 -1437831799.838196 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] record_version: count = 771 [3] content_type: count = 22 [4] length: count = 262 -1437831799.838197 ssl_change_cipher_spec - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_change_cipher_spec + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T -1437831799.838197 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] record_version: count = 771 [3] content_type: count = 20 [4] length: count = 1 -1437831800.045701 ssl_change_cipher_spec - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_change_cipher_spec + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F -1437831800.045701 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] record_version: count = 771 [3] content_type: count = 20 [4] length: count = 1 -1437831800.045701 ssl_established - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_established + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 net_done - [0] t: time = 1437831800.217854 +XXXXXXXXXX.XXXXXX net_done + [0] t: time = XXXXXXXXXX.XXXXXX -1437831800.217854 Broker::log_flush -1437831800.217854 filter_change_tracking -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=15, num_bytes_ip=2873, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=15, num_bytes_ip=2873, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=3, num_bytes_ip=156, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=3, num_bytes_ip=156, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=17, num_bytes_ip=1865, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=17, num_bytes_ip=1865, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] -1437831800.217854 zeek_done -1437831800.217854 ChecksumOffloading::check +XXXXXXXXXX.XXXXXX zeek_done +XXXXXXXXXX.XXXXXX ChecksumOffloading::check diff --git a/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/really-all-events.log b/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/really-all-events.log index 93044aef05..4e680d83c7 100644 --- a/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/really-all-events.log +++ b/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/really-all-events.log @@ -1,122 +1,123 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. 0.000000 zeek_init 0.000000 NetControl::init 0.000000 filter_change_tracking -1254722767.492060 NetControl::init_done -1254722767.492060 network_time_init -1254722767.492060 Broker::log_flush -1254722767.492060 ChecksumOffloading::check -1254722767.492060 filter_change_tracking -1254722767.492060 event_queue_flush_point -1254722767.492060 new_connection - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX NetControl::init_done +XXXXXXXXXX.XXXXXX network_time_init +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX ChecksumOffloading::check +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.492060 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=62, id=9482, ttl=128, p=17, src=10.10.1.4, dst=10.10.1.1], ip6=, tcp=, udp=[sport=56166/udp, dport=53/udp, ulen=42], icmp=] -1254722767.492060 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = yV\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x04mail\x08patriots\x02in\x00\x00\x01\x00\x01 -1254722767.492060 udp_request - [0] u: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX udp_request + [0] u: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.492060 dns_message - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_message + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=F, AA=F, TC=F, RD=T, RA=F, Z=0, num_queries=1, num_answers=0, num_auth=0, num_addl=0] [3] len: count = 34 -1254722767.492060 dns_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=, qclass=, qclass_name=, qtype=, qtype_name=, rcode=, rcode_name=, AA=F, TC=F, RD=F, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=, qclass=, qclass_name=, qtype=, qtype_name=, rcode=, rcode_name=, AA=F, TC=F, RD=F, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=, qclass=, qclass_name=, qtype=, qtype_name=, rcode=, rcode_name=, AA=F, TC=F, RD=F, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=, qclass=, qclass_name=, qtype=, qtype_name=, rcode=, rcode_name=, AA=F, TC=F, RD=F, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=F, AA=F, TC=F, RD=T, RA=F, Z=0, num_queries=1, num_answers=0, num_auth=0, num_addl=0] [2] query: string = mail.patriots.in [3] qtype: count = 1 [4] qclass: count = 1 [5] original_query: string = mail.patriots.in -1254722767.492060 protocol_confirmation - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX protocol_confirmation + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] atype: enum = Analyzer::ANALYZER_DNS [2] aid: count = 3 -1254722767.492060 dns_end - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=0 secs, service={\x0aDNS\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_end + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0aDNS\x0a}, history=D, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=F, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=F, AA=F, TC=F, RD=T, RA=F, Z=0, num_queries=1, num_answers=0, num_auth=0, num_addl=0] -1254722767.492060 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=76, cap_len=76, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=62, id=9482, ttl=128, p=17, src=10.10.1.4, dst=10.10.1.1], ip6=, tcp=, udp=[sport=56166/udp, dport=53/udp, ulen=42], icmp=] -1254722767.492060 event_queue_flush_point -1254722767.492060 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722767.492060 event_queue_flush_point -1254722767.526085 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=128, id=0, ttl=64, p=17, src=10.10.1.1, dst=10.10.1.4], ip6=, tcp=, udp=[sport=53/udp, dport=56166/udp, ulen=108], icmp=] -1254722767.526085 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = yV\x81\x80\x00\x01\x00\x02\x00\x02\x00\x00\x04mail\x08patriots\x02in\x00\x00\x01\x00\x01\xc0\x0c\x00\x05\x00\x01\x00\x00*K\x00\x02\xc0\x11\xc0\x11\x00\x01\x00\x01\x00\x00*L\x00\x04J5\x8c\x99\xc0\x11\x00\x02\x00\x01\x00\x01C\x8c\x00\x06\x03ns2\xc0\x11\xc0\x11\x00\x02\x00\x01\x00\x01C\x8c\x00\x06\x03ns1\xc0\x11 -1254722767.526085 udp_reply - [0] u: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX udp_reply + [0] u: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.526085 dns_message - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_message + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], dns_state=[pending_query=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=, rcode_name=, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=, total_replies=, saw_query=T, saw_reply=F], pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] [3] len: count = 100 -1254722767.526085 dns_query_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_query_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] [2] query: string = mail.patriots.in [3] qtype: count = 1 [4] qclass: count = 1 [5] original_query: string = mail.patriots.in -1254722767.526085 dns_CNAME_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_CNAME_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=F, Z=0, answers=, TTLs=, rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] [2] ans: dns_answer = [answer_type=1, query=mail.patriots.in, qtype=5, qclass=1, TTL=3.0 hrs 27.0 secs] [3] name: string = patriots.in -1254722767.526085 dns_A_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in], TTLs=[3.0 hrs 27.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_A_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in], TTLs=[3.0 hrs 27.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] [2] ans: dns_answer = [answer_type=1, query=patriots.in, qtype=1, qclass=1, TTL=3.0 hrs 28.0 secs] [3] a: addr = 74.53.140.153 -1254722767.526085 dns_end - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in, 74.53.140.153], TTLs=[3.0 hrs 27.0 secs, 3.0 hrs 28.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX dns_end + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=[ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in, 74.53.140.153], TTLs=[3.0 hrs 27.0 secs, 3.0 hrs 28.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=F], dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] msg: dns_msg = [id=31062, opcode=0, rcode=0, QR=T, AA=F, TC=F, RD=T, RA=T, Z=0, num_queries=1, num_answers=2, num_auth=2, num_addl=0] -1254722767.526085 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=142, cap_len=142, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=128, id=0, ttl=64, p=17, src=10.10.1.1, dst=10.10.1.4], ip6=, tcp=, udp=[sport=53/udp, dport=56166/udp, ulen=108], icmp=] -1254722767.526085 event_queue_flush_point -1254722767.526085 DNS::log_dns - [0] rec: DNS::Info = [ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in, 74.53.140.153], TTLs=[3.0 hrs 27.0 secs, 3.0 hrs 28.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=T] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX DNS::log_dns + [0] rec: DNS::Info = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, trans_id=31062, rtt=34.0 msecs 24.953842 usecs, query=mail.patriots.in, qclass=1, qclass_name=C_INTERNET, qtype=1, qtype_name=A, rcode=0, rcode_name=NOERROR, AA=F, TC=F, RD=T, RA=T, Z=0, answers=[patriots.in, 74.53.140.153], TTLs=[3.0 hrs 27.0 secs, 3.0 hrs 28.0 secs], rejected=F, total_answers=2, total_replies=4, saw_query=T, saw_reply=T] -1254722767.526085 event_queue_flush_point -1254722767.529046 new_connection_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_connection_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.529046 new_connection - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.529046 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=48, id=9488, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795696, ack=0, hl=28, dl=0, reserved=0, flags=2, win=65535], udp=, icmp=] -1254722767.529046 connection_SYN_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_SYN_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=128, size=48, win_size=65535, win_scale=-1, MSS=1460, SACK_OK=T] -1254722767.529046 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = S [3] seq: count = 0 @@ -124,53 +125,53 @@ [5] len: count = 0 [6] payload: string = -1254722767.529046 tcp_option - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 2 [3] optlen: count = 4 -1254722767.529046 tcp_option - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1254722767.529046 tcp_option - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1254722767.529046 tcp_option - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 4 [3] optlen: count = 2 -1254722767.529046 tcp_options - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=2, length=4, data=, mss=1460, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=4, length=2, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=]] -1254722767.529046 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=62, cap_len=62, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=48, id=9488, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795696, ack=0, hl=28, dl=0, reserved=0, flags=2, win=65535], udp=, icmp=] -1254722767.529046 event_queue_flush_point -1254722767.529046 event_queue_flush_point -1254722767.875996 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=48, id=0, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727087, ack=2126795697, hl=28, dl=0, reserved=0, flags=18, win=5840], udp=, icmp=] -1254722767.875996 connection_SYN_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_SYN_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=50, size=48, win_size=5840, win_scale=-1, MSS=1460, SACK_OK=T] -1254722767.875996 connection_established - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_established + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.875996 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = SA [3] seq: count = 0 @@ -178,49 +179,49 @@ [5] len: count = 0 [6] payload: string = -1254722767.875996 tcp_option - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 2 [3] optlen: count = 4 -1254722767.875996 tcp_option - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1254722767.875996 tcp_option - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1254722767.875996 tcp_option - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 4 [3] optlen: count = 2 -1254722767.875996 tcp_options - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 950.054169 usecs, service={\x0a\x0a}, history=Sh, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=2, length=4, data=, mss=1460, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=4, length=2, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=]] -1254722767.875996 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=62, cap_len=62, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=48, id=0, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727087, ack=2126795697, hl=28, dl=0, reserved=0, flags=18, win=5840], udp=, icmp=] -1254722767.875996 event_queue_flush_point -1254722767.875996 event_queue_flush_point -1254722767.876028 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 982.002258 usecs, service={\x0a\x0a}, history=ShA, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 982.002258 usecs, service={\x0a\x0a}, history=ShA, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=9489, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795697, ack=2934727088, hl=20, dl=0, reserved=0, flags=16, win=65535], udp=, icmp=] -1254722767.876028 connection_first_ACK - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 982.002258 usecs, service={\x0a\x0a}, history=ShA, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_first_ACK + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 982.002258 usecs, service={\x0a\x0a}, history=ShA, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722767.876028 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=346.0 msecs 982.002258 usecs, service={\x0a\x0a}, history=ShA, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=346.0 msecs 982.002258 usecs, service={\x0a\x0a}, history=ShA, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1 @@ -228,21 +229,21 @@ [5] len: count = 0 [6] payload: string = -1254722767.876028 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=9489, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795697, ack=2934727088, hl=20, dl=0, reserved=0, flags=16, win=65535], udp=, icmp=] -1254722767.876028 event_queue_flush_point -1254722767.876028 event_queue_flush_point -1254722768.219663 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=221, id=8674, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727088, ack=2126795697, hl=20, dl=181, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722768.219663 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = 220-xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 \x0d\x0a220-We do not authorize the use of this system to transport unsolicited, \x0d\x0a220 and/or bulk e-mail.\x0d\x0a -1254722768.219663 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 1 @@ -250,45 +251,45 @@ [5] len: count = 181 [6] payload: string = 220-xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 \x0d\x0a220-We do not authorize the use of this system to transport unsolicited, \x0d\x0a220 and/or bulk e-mail.\x0d\x0a -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 [5] cont_resp: bool = T -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = We do not authorize the use of this system to transport unsolicited, [5] cont_resp: bool = T -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 We do not authorize the use of this system to transport unsolicited, , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 We do not authorize the use of this system to transport unsolicited, , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = and/or bulk e-mail. [5] cont_resp: bool = F -1254722768.219663 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=235, cap_len=235, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=221, id=8674, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727088, ack=2126795697, hl=20, dl=181, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722768.219663 event_queue_flush_point -1254722768.219663 event_queue_flush_point -1254722768.224809 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=49, id=9503, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795697, ack=2934727269, hl=20, dl=9, reserved=0, flags=24, win=65354], udp=, icmp=] -1254722768.224809 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = EHLO GP\x0d\x0a -1254722768.224809 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 1 @@ -296,29 +297,29 @@ [5] len: count = 9 [6] payload: string = EHLO GP\x0d\x0a -1254722768.224809 protocol_confirmation - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX protocol_confirmation + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=695.0 msecs 762.872696 usecs, service={\x0a\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] atype: enum = Analyzer::ANALYZER_SMTP [2] aid: count = 7 -1254722768.224809 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=695.0 msecs 762.872696 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=695.0 msecs 762.872696 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = EHLO [3] arg: string = GP -1254722768.224809 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=63, cap_len=63, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=49, id=9503, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795697, ack=2934727269, hl=20, dl=9, reserved=0, flags=24, win=65354], udp=, icmp=] -1254722768.224809 event_queue_flush_point -1254722768.224809 event_queue_flush_point -1254722768.565386 Broker::log_flush -1254722768.565386 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 36.0 msecs 339.998245 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 36.0 msecs 339.998245 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8675, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727269, ack=2126795706, hl=20, dl=0, reserved=0, flags=16, win=5840], udp=, icmp=] -1254722768.565386 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 36.0 msecs 339.998245 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 36.0 msecs 339.998245 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 182 @@ -326,22 +327,22 @@ [5] len: count = 0 [6] payload: string = -1254722768.565386 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8675, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727269, ack=2126795706, hl=20, dl=0, reserved=0, flags=16, win=5840], udp=, icmp=] -1254722768.565386 event_queue_flush_point -1254722768.565386 event_queue_flush_point -1254722768.566183 event_queue_flush_point -1254722768.566183 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=177, id=8676, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727269, ack=2126795706, hl=20, dl=137, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722768.566183 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 250-xc90.websitewelcome.com Hello GP [122.162.143.157]\x0d\x0a250-SIZE 52428800\x0d\x0a250-PIPELINING\x0d\x0a250-AUTH PLAIN LOGIN\x0d\x0a250-STARTTLS\x0d\x0a250 HELP\x0d\x0a -1254722768.566183 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 182 @@ -349,72 +350,72 @@ [5] len: count = 137 [6] payload: string = 250-xc90.websitewelcome.com Hello GP [122.162.143.157]\x0d\x0a250-SIZE 52428800\x0d\x0a250-PIPELINING\x0d\x0a250-AUTH PLAIN LOGIN\x0d\x0a250-STARTTLS\x0d\x0a250 HELP\x0d\x0a -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = xc90.websitewelcome.com Hello GP [122.162.143.157] [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 xc90.websitewelcome.com Hello GP [122.162.143.157], path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 xc90.websitewelcome.com Hello GP [122.162.143.157], path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = SIZE 52428800 [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 SIZE 52428800, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 SIZE 52428800, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = PIPELINING [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 PIPELINING, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 PIPELINING, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = AUTH PLAIN LOGIN [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH PLAIN LOGIN, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH PLAIN LOGIN, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = STARTTLS [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 STARTTLS, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 STARTTLS, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = HELP [5] cont_resp: bool = F -1254722768.566183 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=191, cap_len=191, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=177, id=8676, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727269, ack=2126795706, hl=20, dl=137, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722768.566183 event_queue_flush_point -1254722768.566183 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722768.566183 event_queue_flush_point -1254722768.568729 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=9508, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795706, ack=2934727406, hl=20, dl=12, reserved=0, flags=24, win=65217], udp=, icmp=] -1254722768.568729 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = AUTH LOGIN\x0d\x0a -1254722768.568729 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 10 @@ -422,27 +423,27 @@ [5] len: count = 12 [6] payload: string = AUTH LOGIN\x0d\x0a -1254722768.568729 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = AUTH [3] arg: string = LOGIN -1254722768.568729 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=9508, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795706, ack=2934727406, hl=20, dl=12, reserved=0, flags=24, win=65217], udp=, icmp=] -1254722768.568729 event_queue_flush_point -1254722768.568729 event_queue_flush_point -1254722768.911081 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=58, id=8677, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727406, ack=2126795718, hl=20, dl=18, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722768.911081 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 334 VXNlcm5hbWU6\x0d\x0a -1254722768.911081 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 319 @@ -450,29 +451,29 @@ [5] len: count = 18 [6] payload: string = 334 VXNlcm5hbWU6\x0d\x0a -1254722768.911081 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 334 [3] cmd: string = AUTH [4] msg: string = VXNlcm5hbWU6 [5] cont_resp: bool = F -1254722768.911081 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=72, cap_len=72, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=58, id=8677, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727406, ack=2126795718, hl=20, dl=18, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722768.911081 event_queue_flush_point -1254722768.911081 event_queue_flush_point -1254722768.911655 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=70, id=9513, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795718, ack=2934727424, hl=20, dl=30, reserved=0, flags=24, win=65199], udp=, icmp=] -1254722768.911655 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = Z3VycGFydGFwQHBhdHJpb3RzLmlu\x0d\x0a -1254722768.911655 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 22 @@ -480,28 +481,28 @@ [5] len: count = 30 [6] payload: string = Z3VycGFydGFwQHBhdHJpb3RzLmlu\x0d\x0a -1254722768.911655 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = ** [3] arg: string = Z3VycGFydGFwQHBhdHJpb3RzLmlu -1254722768.911655 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=84, cap_len=84, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=70, id=9513, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795718, ack=2934727424, hl=20, dl=30, reserved=0, flags=24, win=65199], udp=, icmp=] -1254722768.911655 event_queue_flush_point -1254722768.911655 event_queue_flush_point -1254722769.253544 event_queue_flush_point -1254722769.253544 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=58, id=8678, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727424, ack=2126795748, hl=20, dl=18, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722769.253544 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 334 UGFzc3dvcmQ6\x0d\x0a -1254722769.253544 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 337 @@ -509,33 +510,33 @@ [5] len: count = 18 [6] payload: string = 334 UGFzc3dvcmQ6\x0d\x0a -1254722769.253544 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 334 [3] cmd: string = AUTH_ANSWER [4] msg: string = UGFzc3dvcmQ6 [5] cont_resp: bool = F -1254722769.253544 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=72, cap_len=72, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=58, id=8678, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727424, ack=2126795748, hl=20, dl=18, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722769.253544 event_queue_flush_point -1254722769.253544 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722769.253544 event_queue_flush_point -1254722769.254118 event_queue_flush_point -1254722769.254118 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=58, id=9518, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795748, ack=2934727442, hl=20, dl=18, reserved=0, flags=24, win=65181], udp=, icmp=] -1254722769.254118 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = cHVuamFiQDEyMw==\x0d\x0a -1254722769.254118 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 52 @@ -543,31 +544,31 @@ [5] len: count = 18 [6] payload: string = cHVuamFiQDEyMw==\x0d\x0a -1254722769.254118 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = ** [3] arg: string = cHVuamFiQDEyMw== -1254722769.254118 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=72, cap_len=72, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=58, id=9518, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795748, ack=2934727442, hl=20, dl=18, reserved=0, flags=24, win=65181], udp=, icmp=] -1254722769.254118 event_queue_flush_point -1254722769.254118 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722769.254118 event_queue_flush_point -1254722769.613798 Broker::log_flush -1254722769.613798 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=70, id=8679, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727442, ack=2126795766, hl=20, dl=30, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722769.613798 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 235 Authentication succeeded\x0d\x0a -1254722769.613798 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 355 @@ -575,29 +576,29 @@ [5] len: count = 30 [6] payload: string = 235 Authentication succeeded\x0d\x0a -1254722769.613798 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 235 [3] cmd: string = AUTH_ANSWER [4] msg: string = Authentication succeeded [5] cont_resp: bool = F -1254722769.613798 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=84, cap_len=84, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=70, id=8679, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727442, ack=2126795766, hl=20, dl=30, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722769.613798 event_queue_flush_point -1254722769.613798 event_queue_flush_point -1254722769.614414 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=76, id=9523, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795766, ack=2934727472, hl=20, dl=36, reserved=0, flags=24, win=65151], udp=, icmp=] -1254722769.614414 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = MAIL FROM: \x0d\x0a -1254722769.614414 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 70 @@ -605,33 +606,33 @@ [5] len: count = 36 [6] payload: string = MAIL FROM: \x0d\x0a -1254722769.614414 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = MAIL [3] arg: string = FROM: -1254722769.614414 smtp_unexpected - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_unexpected + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] msg: string = unexpected command [3] detail: string = MAIL reply = 0 state = 1 -1254722769.614414 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=90, cap_len=90, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=76, id=9523, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795766, ack=2934727472, hl=20, dl=36, reserved=0, flags=24, win=65151], udp=, icmp=] -1254722769.614414 event_queue_flush_point -1254722769.614414 event_queue_flush_point -1254722769.956765 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=48, id=8680, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727472, ack=2126795802, hl=20, dl=8, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722769.956765 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 250 OK\x0d\x0a -1254722769.956765 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 385 @@ -639,30 +640,30 @@ [5] len: count = 8 [6] payload: string = 250 OK\x0d\x0a -1254722769.956765 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = MAIL [4] msg: string = OK [5] cont_resp: bool = F -1254722769.956765 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=62, cap_len=62, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=48, id=8680, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727472, ack=2126795802, hl=20, dl=8, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722769.956765 event_queue_flush_point -1254722769.956765 event_queue_flush_point -1254722769.957250 event_queue_flush_point -1254722769.957250 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=79, id=9528, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795802, ack=2934727480, hl=20, dl=39, reserved=0, flags=24, win=65143], udp=, icmp=] -1254722769.957250 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = RCPT TO: \x0d\x0a -1254722769.957250 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 106 @@ -670,30 +671,30 @@ [5] len: count = 39 [6] payload: string = RCPT TO: \x0d\x0a -1254722769.957250 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1254722769.957250 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=93, cap_len=93, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=79, id=9528, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795802, ack=2934727480, hl=20, dl=39, reserved=0, flags=24, win=65143], udp=, icmp=] -1254722769.957250 event_queue_flush_point -1254722769.957250 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722769.957250 event_queue_flush_point -1254722770.319708 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=54, id=8681, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727480, ack=2126795841, hl=20, dl=14, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722770.319708 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 250 Accepted\x0d\x0a -1254722770.319708 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 393 @@ -701,29 +702,29 @@ [5] len: count = 14 [6] payload: string = 250 Accepted\x0d\x0a -1254722770.319708 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Accepted [5] cont_resp: bool = F -1254722770.319708 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=68, cap_len=68, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=54, id=8681, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727480, ack=2126795841, hl=20, dl=14, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722770.319708 event_queue_flush_point -1254722770.319708 event_queue_flush_point -1254722770.320203 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=46, id=9533, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795841, ack=2934727494, hl=20, dl=6, reserved=0, flags=24, win=65129], udp=, icmp=] -1254722770.320203 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = DATA\x0d\x0a -1254722770.320203 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 145 @@ -731,32 +732,32 @@ [5] len: count = 6 [6] payload: string = DATA\x0d\x0a -1254722770.320203 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = DATA [3] arg: string = -1254722770.320203 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] -1254722770.320203 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=46, id=9533, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795841, ack=2934727494, hl=20, dl=6, reserved=0, flags=24, win=65129], udp=, icmp=] -1254722770.320203 event_queue_flush_point -1254722770.320203 event_queue_flush_point -1254722770.661679 Broker::log_flush -1254722770.661679 event_queue_flush_point -1254722770.661679 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=96, id=8682, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727494, ack=2126795847, hl=20, dl=56, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722770.661679 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] contents: string = 354 Enter message, ending with "." on a line by itself\x0d\x0a -1254722770.661679 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 407 @@ -764,32 +765,32 @@ [5] len: count = 56 [6] payload: string = 354 Enter message, ending with "." on a line by itself\x0d\x0a -1254722770.661679 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 354 [3] cmd: string = DATA [4] msg: string = Enter message, ending with "." on a line by itself [5] cont_resp: bool = F -1254722770.661679 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=110, cap_len=110, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=96, id=8682, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727494, ack=2126795847, hl=20, dl=56, reserved=0, flags=24, win=5840], udp=, icmp=] -1254722770.661679 event_queue_flush_point -1254722770.661679 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722770.661679 event_queue_flush_point -1254722770.692743 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1500, id=9551, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795847, ack=2934727550, hl=20, dl=1460, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.692743 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] contents: string = From: "Gurpartap Singh" \x0d\x0aTo: \x0d\x0aSubject: SMTP\x0d\x0aDate: Mon, 5 Oct 2009 11:36:07 +0530\x0d\x0aMessage-ID: <000301ca4581$ef9e57f0$cedb07d0$@in>\x0d\x0aMIME-Version: 1.0\x0d\x0aContent-Type: multipart/mixed;\x0d\x0a\x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0"\x0d\x0aX-Mailer: Microsoft Office Outlook 12.0\x0d\x0aThread-Index: AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==\x0d\x0aContent-Language: en-us\x0d\x0ax-cr-hashedpuzzle: SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA=\x0d\x0ax-cr-puzzleid: {CAA37F59-1850-45C7-8540-AA27696B5398}\x0d\x0a\x0d\x0aThis is a multipart message in MIME format.\x0d\x0a\x0d\x0a------=_NextPart_000_0004_01CA45B0.095693F0\x0d\x0aContent-Type: multipart/alternative;\x0d\x0a\x09boundary="----=_NextPart_001_0005_01CA45B0.095693F0"\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0\x0d\x0aContent-Type: text/plain;\x0d\x0a\x09charset="us-ascii"\x0d\x0aContent-Transfer-Encoding: 7bit\x0d\x0a\x0d\x0aHello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0\x0d\x0aContent-Type: text/html;\x0d\x0a\x09charset="us-ascii"\x0d\x0aContent-Transfer-Encoding: quoted-printable\x0d\x0a\x0d\x0a, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 151 @@ -797,482 +798,482 @@ [5] len: count = 1460 [6] payload: string = From: "Gurpartap Singh" \x0d\x0aTo: \x0d\x0aSubject: SMTP\x0d\x0aDate: Mon, 5 Oct 2009 11:36:07 +0530\x0d\x0aMessage-ID: <000301ca4581$ef9e57f0$cedb07d0$@in>\x0d\x0aMIME-Version: 1.0\x0d\x0aContent-Type: multipart/mixed;\x0d\x0a\x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0"\x0d\x0aX-Mailer: Microsoft Office Outlook 12.0\x0d\x0aThread-Index: AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==\x0d\x0aContent-Language: en-us\x0d\x0ax-cr-hashedpuzzle: SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA=\x0d\x0ax-cr-puzzleid: {CAA37F59-1850-45C7-8540-AA27696B5398}\x0d\x0a\x0d\x0aThis is a multipart message in MIME format.\x0d\x0a\x0d\x0a------=_NextPart_000_0004_01CA45B0.095693F0\x0d\x0aContent-Type: multipart/alternative;\x0d\x0a\x09boundary="----=_NextPart_001_0005_01CA45B0.095693F0"\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0\x0d\x0aContent-Type: text/plain;\x0d\x0a\x09charset="us-ascii"\x0d\x0aContent-Transfer-Encoding: 7bit\x0d\x0a\x0d\x0aHello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0\x0d\x0aContent-Type: text/html;\x0d\x0a\x09charset="us-ascii"\x0d\x0aContent-Transfer-Encoding: quoted-printable\x0d\x0a\x0d\x0a, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = From: "Gurpartap Singh" -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=From, name=FROM, value="Gurpartap Singh" ] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = To: -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=To, name=TO, value=] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Subject: SMTP -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Subject, name=SUBJECT, value=SMTP] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Date: Mon, 5 Oct 2009 11:36:07 +0530 -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Date, name=DATE, value=Mon, 5 Oct 2009 11:36:07 +0530] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Message-ID: <000301ca4581$ef9e57f0$cedb07d0$@in> -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Message-ID, name=MESSAGE-ID, value=<000301ca4581$ef9e57f0$cedb07d0$@in>] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = MIME-Version: 1.0 -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=MIME-Version, name=MIME-VERSION, value=1.0] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Type: multipart/mixed; -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = \x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0" -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=multipart/mixed;\x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0"] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = X-Mailer: Microsoft Office Outlook 12.0 -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=X-Mailer, name=X-MAILER, value=Microsoft Office Outlook 12.0] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Thread-Index: AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A== -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Thread-Index, name=THREAD-INDEX, value=AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Language: en-us -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Language, name=CONTENT-LANGUAGE, value=en-us] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = x-cr-hashedpuzzle: SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA= -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=x-cr-hashedpuzzle, name=X-CR-HASHEDPUZZLE, value=SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA=] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = x-cr-puzzleid: {CAA37F59-1850-45C7-8540-AA27696B5398} -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=x-cr-puzzleid, name=X-CR-PUZZLEID, value={CAA37F59-1850-45C7-8540-AA27696B5398}] -1254722770.692743 mime_all_headers - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_all_headers + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] hlist: table[count] of mime_header_rec = {\x0a\x09[2] = [original_name=To, name=TO, value=],\x0a\x09[11] = [original_name=x-cr-hashedpuzzle, name=X-CR-HASHEDPUZZLE, value=SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA=],\x0a\x09[5] = [original_name=Message-ID, name=MESSAGE-ID, value=<000301ca4581$ef9e57f0$cedb07d0$@in>],\x0a\x09[7] = [original_name=Content-Type, name=CONTENT-TYPE, value=multipart/mixed;\x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0"],\x0a\x09[6] = [original_name=MIME-Version, name=MIME-VERSION, value=1.0],\x0a\x09[10] = [original_name=Content-Language, name=CONTENT-LANGUAGE, value=en-us],\x0a\x09[4] = [original_name=Date, name=DATE, value=Mon, 5 Oct 2009 11:36:07 +0530],\x0a\x09[12] = [original_name=x-cr-puzzleid, name=X-CR-PUZZLEID, value={CAA37F59-1850-45C7-8540-AA27696B5398}],\x0a\x09[8] = [original_name=X-Mailer, name=X-MAILER, value=Microsoft Office Outlook 12.0],\x0a\x09[3] = [original_name=Subject, name=SUBJECT, value=SMTP],\x0a\x09[9] = [original_name=Thread-Index, name=THREAD-INDEX, value=AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==],\x0a\x09[1] = [original_name=From, name=FROM, value="Gurpartap Singh" ]\x0a} -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = This is a multipart message in MIME format. -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = ------=_NextPart_000_0004_01CA45B0.095693F0 -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Type: multipart/alternative; -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = \x09boundary="----=_NextPart_001_0005_01CA45B0.095693F0" -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=multipart/alternative;\x09boundary="----=_NextPart_001_0005_01CA45B0.095693F0"] -1254722770.692743 mime_all_headers - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_all_headers + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] [1] hlist: table[count] of mime_header_rec = {\x0a\x09[1] = [original_name=Content-Type, name=CONTENT-TYPE, value=multipart/alternative;\x09boundary="----=_NextPart_001_0005_01CA45B0.095693F0"]\x0a} -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=2, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=2], socks=, ssh=, syslog=] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = ------=_NextPart_001_0005_01CA45B0.095693F0 -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Type: text/plain; -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = \x09charset="us-ascii" -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain;\x09charset="us-ascii"] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Transfer-Encoding: 7bit -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=7bit] -1254722770.692743 mime_all_headers - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_all_headers + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] hlist: table[count] of mime_header_rec = {\x0a\x09[2] = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=7bit],\x0a\x09[1] = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain;\x09charset="us-ascii"]\x0a} -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 5 [2] data: string = Hello -1254722770.692743 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 event_queue_flush_point -1254722770.692743 file_new - [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1254722770.692743 event_queue_flush_point -1254722770.692743 file_over_new_connection - [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1254722770.692743, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 event_queue_flush_point -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Hello -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 3 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 26 [2] data: string = \x0d\x0aI send u smtp pcap file -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = I send u smtp pcap file -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 21 [2] data: string = \x0d\x0aFind the attachment -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Find the attachment -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 3 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 5 [2] data: string = \x0d\x0aGPS -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = GPS -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_entity_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_entity_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [1] length: count = 77 [2] data: string = Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a -1254722770.692743 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] -1254722770.692743 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 event_queue_flush_point -1254722770.692743 file_sniff - [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a, info=[ts=1254722770.692743, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T] -1254722770.692743 event_queue_flush_point -1254722770.692743 file_state_remove - [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a, info=[ts=1254722770.692743, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=FmFp351N5nhsMmAfQg, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1254722770.692743 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722770.692743 event_queue_flush_point -1254722770.692743 Files::log_files - [0] rec: Files::Info = [ts=1254722770.692743, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Files::log_files + [0] rec: Files::Info = [ts=XXXXXXXXXX.XXXXXX, fuid=FmFp351N5nhsMmAfQg, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=3, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=77, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=] -1254722770.692743 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=3, entity=, fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=3], socks=, ssh=, syslog=] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = ------=_NextPart_001_0005_01CA45B0.095693F0 -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Type: text/html; -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = \x09charset="us-ascii" -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=text/html;\x09charset="us-ascii"] -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Transfer-Encoding: quoted-printable -1254722770.692743 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=quoted-printable] -1254722770.692743 mime_all_headers - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_all_headers + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] hlist: table[count] of mime_header_rec = {\x0a\x09[2] = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=quoted-printable],\x0a\x09[1] = [original_name=Content-Type, name=CONTENT-TYPE, value=text/html;\x09charset="us-ascii"]\x0a} -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692743 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 46 [2] data: string = , vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 event_queue_flush_point -1254722770.692743 file_new - [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1254722770.692743 event_queue_flush_point -1254722770.692743 file_over_new_connection - [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692743, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1254722770.692743, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692743 event_queue_flush_point -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = , vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 50 [2] data: string = xmlns:o="urn:schemas-microsoft-com:office:office" -1254722770.692743 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=1610, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 697.004318 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = xmlns:o=3D"urn:schemas-microsoft-com:office:office" = -1254722770.692743 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1514, cap_len=1514, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1500, id=9551, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795847, ack=2934727550, hl=20, dl=1460, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.692743 event_queue_flush_point -1254722770.692743 event_queue_flush_point -1254722770.692786 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1500, id=9552, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126797307, ack=2934727550, hl=20, dl=1460, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.692786 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] contents: string = ft-com:office:word" =\x0d\x0axmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =\x0d\x0axmlns=3D"http://www.w3.org/TR/REC-html40">\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d -1254722770.692786 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1611 @@ -1280,571 +1281,571 @@ [5] len: count = 1460 [6] payload: string = ft-com:office:word" =\x0d\x0axmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =\x0d\x0axmlns=3D"http://www.w3.org/TR/REC-html40">\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 48 [2] data: string = xmlns:w="urn:schemas-microsoft-com:office:word" -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = xmlns:w=3D"urn:schemas-microsoft-com:office:word" = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 59 [2] data: string = xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = xmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 42 [2] data: string = xmlns="http://www.w3.org/TR/REC-html40">\x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = xmlns=3D"http://www.w3.org/TR/REC-html40"> -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 8 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 52 [2] data: string = , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = , vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 20 [2] data: string = charset=us-ascii">\x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = charset=3Dus-ascii"> -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 26 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 42 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692786 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 22 [2] data: string =
\x0d\x0a -1254722770.692786 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=3070, state=4, num_pkts=10, num_bytes_ip=2018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 739.919662 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string =
-1254722770.692786 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1514, cap_len=1514, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1500, id=9552, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126797307, ack=2934727550, hl=20, dl=1460, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.692786 event_queue_flush_point -1254722770.692786 event_queue_flush_point -1254722770.692804 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1500, id=9553, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126798767, ack=2934727550, hl=20, dl=1460, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.692804 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] contents: string = \x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0--\x0d\x0a\x0d\x0a------=_NextPart_000_0004_01CA45B0.095693F0\x0d\x0aContent-Type: text/plain;\x0d\x0a\x09name="NEWS.txt"\x0d\x0aContent-Transfer-Encoding: quoted-printable\x0d\x0aContent-Disposition: attachment;\x0d\x0a\x09filename="NEWS.txt"\x0d\x0a\x0d\x0aVersion 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when =\x0d\x0ait is needed\x0d\x0a* Added new compiler/linker options:=20\x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, =\x0d\x0ai686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4,=20\x0d\x0a k6, k6-2, k6-3 -1254722770.692804 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 3071 @@ -1852,612 +1853,612 @@ [5] len: count = 1460 [6] payload: string = \x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0--\x0d\x0a\x0d\x0a------=_NextPart_000_0004_01CA45B0.095693F0\x0d\x0aContent-Type: text/plain;\x0d\x0a\x09name="NEWS.txt"\x0d\x0aContent-Transfer-Encoding: quoted-printable\x0d\x0aContent-Disposition: attachment;\x0d\x0a\x09filename="NEWS.txt"\x0d\x0a\x0d\x0aVersion 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when =\x0d\x0ait is needed\x0d\x0a* Added new compiler/linker options:=20\x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, =\x0d\x0ai686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4,=20\x0d\x0a k6, k6-2, k6-3 -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 41 [2] data: string =

Hello

\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string =

Hello

-1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 42 [2] data: string =

 

\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string =

 

-1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 60 [2] data: string =

I send u smtp pcap file

\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string =

I send u smtp pcap file

-1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 55 [2] data: string =

Find the attachment

\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string =

Find the attachment

-1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 42 [2] data: string =

 

\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string =

 

-1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 39 [2] data: string =

GPS

\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string =

GPS

-1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 8 [2] data: string =
\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string =
-1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_entity_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_entity_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 1868 [2] data: string = \x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a -1254722770.692804 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692804 event_queue_flush_point -1254722770.692804 file_sniff - [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692804, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a, info=[ts=1254722770.692743, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=text/html, mime_types=[[strength=100, mime=text/html], [strength=20, mime=text/html], [strength=-20, mime=text/plain]], inferred=T] -1254722770.692804 event_queue_flush_point -1254722770.692804 file_state_remove - [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692804, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a, info=[ts=1254722770.692743, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=text/html, filename=, duration=61.035156 usecs, local_orig=, is_orig=T, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=Fqrb1K5DWEfgy4WU2, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=text/html, filename=, duration=61.035156 usecs, local_orig=, is_orig=T, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722770.692804 event_queue_flush_point -1254722770.692804 Files::log_files - [0] rec: Files::Info = [ts=1254722770.692743, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=text/html, filename=, duration=61.035156 usecs, local_orig=, is_orig=T, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Files::log_files + [0] rec: Files::Info = [ts=XXXXXXXXXX.XXXXXX, fuid=Fqrb1K5DWEfgy4WU2, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=4, analyzers={\x0a\x0a}, mime_type=text/html, filename=, duration=61.035156 usecs, local_orig=, is_orig=T, seen_bytes=1868, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=] -1254722770.692804 mime_entity_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_entity_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] length: count = 0 [2] data: string = -1254722770.692804 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692804 event_queue_flush_point -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722770.692804 event_queue_flush_point -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = ------=_NextPart_001_0005_01CA45B0.095693F0-- -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_begin_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=4, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=4], socks=, ssh=, syslog=] -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = ------=_NextPart_000_0004_01CA45B0.095693F0 -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Type: text/plain; -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = \x09name="NEWS.txt" -1254722770.692804 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain;\x09name="NEWS.txt"] -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Transfer-Encoding: quoted-printable -1254722770.692804 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=quoted-printable] -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Disposition: attachment; -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = \x09filename="NEWS.txt" -1254722770.692804 mime_one_header - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Disposition, name=CONTENT-DISPOSITION, value=attachment;\x09filename="NEWS.txt"] -1254722770.692804 mime_all_headers - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_all_headers + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] hlist: table[count] of mime_header_rec = {\x0a\x09[2] = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=quoted-printable],\x0a\x09[1] = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain;\x09name="NEWS.txt"],\x0a\x09[3] = [original_name=Content-Disposition, name=CONTENT-DISPOSITION, value=attachment;\x09filename="NEWS.txt"]\x0a} -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.9.1\x0d\x0a -1254722770.692804 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692804 event_queue_flush_point -1254722770.692804 file_new - [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692804, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1254722770.692804 event_queue_flush_point -1254722770.692804 file_over_new_connection - [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=1254722770.692804, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1254722770.692804, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722770.692804 event_queue_flush_point -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.9.1 -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 18 [2] data: string = * Many bug fixes\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Many bug fixes -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 19 [2] data: string = * Improved editor\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Improved editor -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.9.0\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.9.0 -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 51 [2] data: string = * Support for latest Mingw compiler system builds\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Support for latest Mingw compiler system builds -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.8.9\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.8.9 -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 28 [2] data: string = * New code tooltip display\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New code tooltip display -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 47 [2] data: string = * Improved Indent/Unindent and Remove Comment\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Improved Indent/Unindent and Remove Comment -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 29 [2] data: string = * Improved automatic indent\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Improved automatic indent -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 45 [2] data: string = * Added support for the "interface" keyword\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added support for the "interface" keyword -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 66 [2] data: string = * WebUpdate should now report installation problems from PackMan\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * WebUpdate should now report installation problems from PackMan -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 43 [2] data: string = * New splash screen and association icons\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New splash screen and association icons -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 22 [2] data: string = * Improved installer\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Improved installer -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 18 [2] data: string = * Many bug fixes\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Many bug fixes -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.8.7\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.8.7 -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 31 [2] data: string = * Added support for GCC > 3.2\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added support for GCC > 3.2 -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 60 [2] data: string = * Debug variables are now resent during next debug session\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Debug variables are now resent during next debug session -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = * Watched Variables not in correct context are now kept and updated when -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Watched Variables not in correct context are now kept and updated when = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 14 [2] data: string = it is needed\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = it is needed -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 39 [2] data: string = * Added new compiler/linker options: \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added new compiler/linker options:=20 -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 22 [2] data: string = - Strip executable\x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = - Strip executable -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 68 [2] data: string = - Generate instructions for a specific machine (i386, i486, i586, -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = - Generate instructions for a specific machine (i386, i486, i586, = -1254722770.692804 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 72 [2] data: string = i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a -1254722770.692804 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=4530, state=4, num_pkts=11, num_bytes_ip=3518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 758.039474 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4,=20 -1254722770.692804 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1514, cap_len=1514, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1500, id=9553, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126798767, ack=2934727550, hl=20, dl=1460, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.692804 event_queue_flush_point -1254722770.692804 event_queue_flush_point -1254722770.692823 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1500, id=9554, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126800227, ack=2934727550, hl=20, dl=1460, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.692823 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = , athlon, athlon-tbird, athlon-4, athlon-xp, =\x0d\x0aathlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, =\x0d\x0asse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during =\x0d\x0adebugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose =\x0d\x0abetween using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code =\x0d\x0acompletion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages =\x0d\x0adirectory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of =\x0d\x0aall the standard=20\x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile.=20\x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment =\x0d\x0aOptions=20\x0d\x0a (still can be overriden by using "-c -1254722770.692823 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 4531 @@ -2465,414 +2466,413 @@ [5] len: count = 1460 [6] payload: string = , athlon, athlon-tbird, athlon-4, athlon-xp, =\x0d\x0aathlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, =\x0d\x0asse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during =\x0d\x0adebugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose =\x0d\x0abetween using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code =\x0d\x0acompletion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages =\x0d\x0adirectory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of =\x0d\x0aall the standard=20\x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile.=20\x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment =\x0d\x0aOptions=20\x0d\x0a (still can be overriden by using "-c -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 63 [2] data: string = k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 51 [2] data: string = athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2) -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 68 [2] data: string = - Enable use of processor specific built-in functions (mmmx, sse, -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = - Enable use of processor specific built-in functions (mmmx, sse, = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 19 [2] data: string = sse2, pni, 3dnow)\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = sse2, pni, 3dnow) -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 48 [2] data: string = * "Default" button in Compiler Options is back\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * "Default" button in Compiler Options is back -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 35 [2] data: string = * Error messages parsing improved\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Error messages parsing improved -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.8.5\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.8.5 -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 65 [2] data: string = * Added the possibility to modify the value of a variable during -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added the possibility to modify the value of a variable during = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = debugging (right click on a watch variable and select "Modify value")\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = debugging (right click on a watch variable and select "Modify value") -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = * During Dev-C++ First Time COnfiguration window, users can now choose -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * During Dev-C++ First Time COnfiguration window, users can now choose = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 66 [2] data: string = between using or not class browser and code completion features.\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = between using or not class browser and code completion features. -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 18 [2] data: string = * Many bug fixes\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Many bug fixes -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.8.4\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.8.4 -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = * Added the possibility to specify an include directory for the code -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added the possibility to specify an include directory for the code = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 57 [2] data: string = completion cache to be created at Dev-C++ first startup\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = completion cache to be created at Dev-C++ first startup -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 34 [2] data: string = * Improved code completion cache\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Improved code completion cache -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 67 [2] data: string = * WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 56 [2] data: string = directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = directory, and Dev-C++ executable in devcpp.exe.BACKUP -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 61 [2] data: string = * Big speed up in function parameters listing while editing\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Big speed up in function parameters listing while editing -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.8.3\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.8.3 -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = * On Dev-C++ first time configuration dialog, a code completion cache of -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * On Dev-C++ first time configuration dialog, a code completion cache of = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 19 [2] data: string = all the standard \x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = all the standard=20 -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 39 [2] data: string = include files can now be generated.\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = include files can now be generated. -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 29 [2] data: string = * Improved WebUpdate module\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Improved WebUpdate module -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 18 [2] data: string = * Many bug fixes\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Many bug fixes -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.8.2\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.8.2 -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 59 [2] data: string = * New debug feature for DLLs: attach to a running process\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New debug feature for DLLs: attach to a running process -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 45 [2] data: string = * New project option: Use custom Makefile. \x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New project option: Use custom Makefile.=20 -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 26 [2] data: string = * New WebUpdater module.\x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New WebUpdater module. -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = * Allow user to specify an alternate configuration file in Environment -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Allow user to specify an alternate configuration file in Environment = -1254722770.692823 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 10 [2] data: string = Options \x0d\x0a -1254722770.692823 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=12, num_bytes_ip=5018, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 163.0 msecs 776.874542 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Options=20 -1254722770.692823 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1514, cap_len=1514, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1500, id=9554, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126800227, ack=2934727550, hl=20, dl=1460, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.692823 event_queue_flush_point -1254722770.692823 event_queue_flush_point -1254722770.695115 new_connection - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=548, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=548, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722770.695115 new_packet - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=548, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=548, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=192, len=576, id=17689, ttl=63, p=1, src=192.168.1.1, dst=10.10.1.4], ip6=, tcp=, udp=, icmp=[icmp_type=3]] -1254722770.695115 packet_contents - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=548, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=548, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = E\x00\x05\xdc%O@\x00~\x06\xef\xf0\x0a\x0a\x01\x04J5\x8c\x99\x05\xbe\x00\x19~\xc4TG\xae\xecc~P\x10\xfe1\x1f\xe6\x00\x00From: "Gurpartap Singh" \x0d\x0aTo: \x0d\x0aSubject: SMTP\x0d\x0aDate: Mon, 5 Oct 2009 11:36:07 +0530\x0d\x0aMessage-ID: <000301ca4581$ef9e57f0$cedb07d0$@in>\x0d\x0aMIME-Version: 1.0\x0d\x0aContent-Type: multipart/mixed;\x0d\x0a\x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0"\x0d\x0aX-Mailer: Microsoft Office Outlook 12.0\x0d\x0aThread-Index: AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==\x0d\x0aContent-Language: en-us\x0d\x0ax-cr-hashedpuzzle: SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;c -1254722770.695115 icmp_unreachable - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=548, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] - [1] icmp: icmp_conn = [orig_h=192.168.1.1, resp_h=10.10.1.4, itype=3, icode=4, len=548, hlim=63, v6=F] - [2] info: icmp_info = [v6=F, itype=3, icode=4, len=548, ttl=63] - [3] code: count = 4 - [4] context: icmp_context = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], len=1500, proto=1, frag_offset=0, bad_hdr_len=F, bad_checksum=F, MF=F, DF=T] +XXXXXXXXXX.XXXXXX icmp_unreachable + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=548, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] + [1] info: icmp_info = [v6=F, itype=3, icode=4, len=548, ttl=63] + [2] code: count = 4 + [3] context: icmp_context = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], len=1500, proto=1, frag_offset=0, bad_hdr_len=F, bad_checksum=F, MF=F, DF=T] -1254722770.695115 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=590, cap_len=590, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=192, len=576, id=17689, ttl=63, p=1, src=192.168.1.1, dst=10.10.1.4], ip6=, tcp=, udp=, icmp=[icmp_type=3]] -1254722770.695115 event_queue_flush_point -1254722770.695115 event_queue_flush_point -1254722770.695170 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=13, num_bytes_ip=6518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 166.0 msecs 123.867035 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=13, num_bytes_ip=6518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 166.0 msecs 123.867035 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9555, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795847, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.695170 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=13, num_bytes_ip=6518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 166.0 msecs 123.867035 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=13, num_bytes_ip=6518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 166.0 msecs 123.867035 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = From: "Gurpartap Singh" \x0d\x0aTo: \x0d\x0aSubject: SMTP\x0d\x0aDate: Mon, 5 Oct 2009 11:36:07 +0530\x0d\x0aMessage-ID: <000301ca4581$ef9e57f0$cedb07d0$@in>\x0d\x0aMIME-Version: 1.0\x0d\x0aContent-Type: multipart/mixed;\x0d\x0a\x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0"\x0d\x0aX-Mailer: Microsoft Office Outlook 12.0\x0d\x0aThread-Index: AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==\x0d\x0aContent-Language: en-us\x0d\x0ax-cr-hashedpuzzle: SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA=\x0d\x0ax-cr-puzzleid: {CAA37F59-1850-45C7-8540-AA27696B5398}\x0d\x0a\x0d\x0aThis is a multipart message in MIME format.\x0d\x0a\x0d\x0a------=_NextPart_000_0004_01CA45B0.095693F0\x0d\x0aContent-Type: multipart/alternative;\x0d\x0a\x09boundary="----=_NextPart_001_0005_01CA45B0.095693F0"\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0\x0d\x0aContent-Type: text/plain;\x0d\x0a\x09charset="us-ascii"\x0d\x0aContent-Transfer-Encoding: 7bit\x0d\x0a\x0d\x0aHello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0\x0d\x0aContent-Type: text/html;\x0d\x0a\x09charset="us-ascii"\x0d\x0aContent-Transfer-Encoding: quoted-printable\x0d\x0a\x0d\x0a, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=13, num_bytes_ip=6518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=10, num_bytes_ip=870, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 166.0 msecs 123.867035 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 151 @@ -2880,77 +2880,74 @@ [5] len: count = 1452 [6] payload: string = From: "Gurpartap Singh" \x0d\x0aTo: \x0d\x0aSubject: SMTP\x0d\x0aDate: Mon, 5 Oct 2009 11:36:07 +0530\x0d\x0aMessage-ID: <000301ca4581$ef9e57f0$cedb07d0$@in>\x0d\x0aMIME-Version: 1.0\x0d\x0aContent-Type: multipart/mixed;\x0d\x0a\x09boundary="----=_NextPart_000_0004_01CA45B0.095693F0"\x0d\x0aX-Mailer: Microsoft Office Outlook 12.0\x0d\x0aThread-Index: AcpFgem9BvjjZEDeR1Kh8i+hUyVo0A==\x0d\x0aContent-Language: en-us\x0d\x0ax-cr-hashedpuzzle: SeA= AAR2 ADaH BpiO C4G1 D1gW FNB1 FPkR Fn+W HFCP HnYJ JO7s Kum6 KytW LFcI LjUt;1;cgBhAGoAXwBkAGUAbwBsADIAMAAwADIAaQBuAEAAeQBhAGgAbwBvAC4AYwBvAC4AaQBuAA==;Sosha1_v1;7;{CAA37F59-1850-45C7-8540-AA27696B5398};ZwB1AHIAcABhAHIAdABhAHAAQABwAGEAdAByAGkAbwB0AHMALgBpAG4A;Mon, 05 Oct 2009 06:06:01 GMT;UwBNAFQAUAA=\x0d\x0ax-cr-puzzleid: {CAA37F59-1850-45C7-8540-AA27696B5398}\x0d\x0a\x0d\x0aThis is a multipart message in MIME format.\x0d\x0a\x0d\x0a------=_NextPart_000_0004_01CA45B0.095693F0\x0d\x0aContent-Type: multipart/alternative;\x0d\x0a\x09boundary="----=_NextPart_001_0005_01CA45B0.095693F0"\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0\x0d\x0aContent-Type: text/plain;\x0d\x0a\x09charset="us-ascii"\x0d\x0aContent-Transfer-Encoding: 7bit\x0d\x0a\x0d\x0aHello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0\x0d\x0aContent-Type: text/html;\x0d\x0a\x09charset="us-ascii"\x0d\x0aContent-Transfer-Encoding: quoted-printable\x0d\x0a\x0d\x0a, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9555, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126795847, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722770.695170 event_queue_flush_point -1254722770.695170 event_queue_flush_point -1254722770.695623 new_packet - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=1096, state=1, num_pkts=1, num_bytes_ip=576, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=507.831573 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=1096, state=1, num_pkts=1, num_bytes_ip=576, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=507.831573 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=192, len=576, id=17690, ttl=63, p=1, src=192.168.1.1, dst=10.10.1.4], ip6=, tcp=, udp=, icmp=[icmp_type=3]] -1254722770.695623 packet_contents - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=1096, state=1, num_pkts=1, num_bytes_ip=576, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=507.831573 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=1096, state=1, num_pkts=1, num_bytes_ip=576, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=507.831573 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = E\x00\x05\xdc%P@\x00~\x06\xef\xef\x0a\x0a\x01\x04J5\x8c\x99\x05\xbe\x00\x19~\xc4Y\xfb\xae\xecc~P\x10\xfe1\xd6\x84\x00\x00ft-com:office:word" =\x0d\x0axmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =\x0d\x0axmlns=3D"http://www.w3.org/TR/REC-html40">\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=14, num_bytes_ip=8010, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 575.0 msecs 925.827026 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1603 @@ -2980,21 +2977,21 @@ [5] len: count = 1452 [6] payload: string = -microsoft-com:office:word" =\x0d\x0axmlns:m=3D"http://schemas.microsoft.com/office/2004/12/omml" =\x0d\x0axmlns=3D"http://www.w3.org/TR/REC-html40">\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9556, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126797299, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.104972 event_queue_flush_point -1254722771.104972 event_queue_flush_point -1254722771.104998 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=15, num_bytes_ip=9502, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 575.0 msecs 952.05307 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=15, num_bytes_ip=9502, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 575.0 msecs 952.05307 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9557, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126798751, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.104998 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=15, num_bytes_ip=9502, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 575.0 msecs 952.05307 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=15, num_bytes_ip=9502, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 575.0 msecs 952.05307 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = ass=3DSection1>\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0--\x0d\x0a\x0d\x0a------=_NextPart_000_0004_01CA45B0.095693F0\x0d\x0aContent-Type: text/plain;\x0d\x0a\x09name="NEWS.txt"\x0d\x0aContent-Transfer-Encoding: quoted-printable\x0d\x0aContent-Disposition: attachment;\x0d\x0a\x09filename="NEWS.txt"\x0d\x0a\x0d\x0aVersion 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when =\x0d\x0ait is needed\x0d\x0a* Added new compiler/linker options:=20\x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, =\x0d\x0ai686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4 -1254722771.104998 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=15, num_bytes_ip=9502, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 575.0 msecs 952.05307 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=15, num_bytes_ip=9502, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 575.0 msecs 952.05307 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 3055 @@ -3002,17 +2999,17 @@ [5] len: count = 1452 [6] payload: string = ass=3DSection1>\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a------=_NextPart_001_0005_01CA45B0.095693F0--\x0d\x0a\x0d\x0a------=_NextPart_000_0004_01CA45B0.095693F0\x0d\x0aContent-Type: text/plain;\x0d\x0a\x09name="NEWS.txt"\x0d\x0aContent-Transfer-Encoding: quoted-printable\x0d\x0aContent-Disposition: attachment;\x0d\x0a\x09filename="NEWS.txt"\x0d\x0a\x0d\x0aVersion 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when =\x0d\x0ait is needed\x0d\x0a* Added new compiler/linker options:=20\x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, =\x0d\x0ai686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4 -1254722771.104998 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1506, cap_len=1506, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9557, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126798751, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.104998 event_queue_flush_point -1254722771.104998 event_queue_flush_point -1254722771.469723 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 676.927567 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 676.927567 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8684, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126798751, hl=20, dl=0, reserved=0, flags=16, win=11616], udp=, icmp=] -1254722771.469723 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 676.927567 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=11, num_bytes_ip=910, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 676.927567 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -3020,22 +3017,22 @@ [5] len: count = 0 [6] payload: string = -1254722771.469723 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8684, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126798751, hl=20, dl=0, reserved=0, flags=16, win=11616], udp=, icmp=] -1254722771.469723 event_queue_flush_point -1254722771.469723 event_queue_flush_point -1254722771.469759 event_queue_flush_point -1254722771.469759 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 712.928772 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 712.928772 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9558, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126800203, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.469759 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 712.928772 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 712.928772 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = ,=20\x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, =\x0d\x0aathlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, =\x0d\x0asse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during =\x0d\x0adebugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose =\x0d\x0abetween using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code =\x0d\x0acompletion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages =\x0d\x0adirectory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of =\x0d\x0aall the standard=20\x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile.=20\x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment =\x0d\x0aOptions=20\x0d\x0a (sti -1254722771.469759 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 712.928772 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=5990, state=4, num_pkts=16, num_bytes_ip=10994, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 712.928772 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 4507 @@ -3043,24 +3040,24 @@ [5] len: count = 1452 [6] payload: string = ,=20\x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, =\x0d\x0aathlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, =\x0d\x0asse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during =\x0d\x0adebugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose =\x0d\x0abetween using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code =\x0d\x0acompletion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages =\x0d\x0adirectory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of =\x0d\x0aall the standard=20\x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile.=20\x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment =\x0d\x0aOptions=20\x0d\x0a (sti -1254722771.469759 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1506, cap_len=1506, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9558, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126800203, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.469759 event_queue_flush_point -1254722771.469759 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722771.469759 event_queue_flush_point -1254722771.469814 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9559, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126801655, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.469814 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = ll can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the =\x0d\x0aproject-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug =\x0d\x0aoutput.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report =\x0d\x0awatch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories =\x0d\x0a(include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look =\x0d\x0astyle\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed =\x0d\x0ato the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing =\x0d\x0aversion\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are =\x0d\x0aperformed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units =\x0d\x0a"Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added -1254722771.469814 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 5959 @@ -3068,527 +3065,527 @@ [5] len: count = 1452 [6] payload: string = ll can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the =\x0d\x0aproject-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug =\x0d\x0aoutput.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report =\x0d\x0awatch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories =\x0d\x0a(include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look =\x0d\x0astyle\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed =\x0d\x0ato the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing =\x0d\x0aversion\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are =\x0d\x0aperformed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units =\x0d\x0a"Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 66 [2] data: string = (still can be overriden by using "-c" command line parameter).\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = (still can be overriden by using "-c" command line parameter). -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 22 [2] data: string = * Lots of bug fixes.\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Lots of bug fixes. -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.8.1\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.8.1 -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 63 [2] data: string = * When creating a DLL, the created static lib respects now the -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * When creating a DLL, the created static lib respects now the = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 34 [2] data: string = project-defined output directory\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = project-defined output directory -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.8.0\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.8.0 -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = * Changed position of compiler/linker parameters in Project Options.\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Changed position of compiler/linker parameters in Project Options. -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 22 [2] data: string = * Improved help file\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Improved help file -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.9\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.9 -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 58 [2] data: string = * Resource errors are now reported in the Resource sheet\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Resource errors are now reported in the Resource sheet -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 18 [2] data: string = * Many bug fixes\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Many bug fixes -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.8\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.8 -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 66 [2] data: string = * Made whole bottom report control floating instead of only debug -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Made whole bottom report control floating instead of only debug = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = output.\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = output. -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 18 [2] data: string = * Many bug fixes\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Many bug fixes -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.7\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.7 -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 35 [2] data: string = * Printing settings are now saved\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Printing settings are now saved -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = * New environment options : "watch variable under mouse" and "Report -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New environment options : "watch variable under mouse" and "Report = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 15 [2] data: string = watch errors"\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = watch errors" -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.6\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.6 -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 26 [2] data: string = * Debug variable browser\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Debug variable browser -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = * Added possibility to include in a Template the Project's directories -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added possibility to include in a Template the Project's directories = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 32 [2] data: string = (include, libs and ressources)\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = (include, libs and ressources) -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = * Changed tint of Class browser pictures colors to match the New Look -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Changed tint of Class browser pictures colors to match the New Look = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 7 [2] data: string = style\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = style -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.5\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.5 -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.4\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.4 -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = * When compiling with debugging symbols, an extra definition is passed -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * When compiling with debugging symbols, an extra definition is passed = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 8 [2] data: string = to the\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = to the -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 25 [2] data: string = compiler: -D__DEBUG__\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = compiler: -D__DEBUG__ -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 66 [2] data: string = * Each project creates a _private.h file containing -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Each project creates a _private.h file containing = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = version\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = version -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 27 [2] data: string = information definitions\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = information definitions -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 65 [2] data: string = * When compiling the current file only, no dependency checks are -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * When compiling the current file only, no dependency checks are = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 11 [2] data: string = performed\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = performed -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 34 [2] data: string = * ~300% Speed-up in class parser\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * ~300% Speed-up in class parser -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 68 [2] data: string = * Added "External programs" in Tools/Environment Options (for units -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added "External programs" in Tools/Environment Options (for units = -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 14 [2] data: string = "Open with")\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = "Open with") -1254722771.469814 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 51 [2] data: string = * Added "Open with" in project units context menu\x0d\x0a -1254722771.469814 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=17, num_bytes_ip=12486, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 940.0 msecs 768.003464 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added "Open with" in project units context menu -1254722771.469814 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1506, cap_len=1506, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9559, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126801655, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.469814 event_queue_flush_point -1254722771.469814 event_queue_flush_point -1254722771.494167 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 121.030807 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 121.030807 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8685, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126800203, hl=20, dl=0, reserved=0, flags=16, win=14520], udp=, icmp=] -1254722771.494167 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 121.030807 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=7410, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=12, num_bytes_ip=950, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 121.030807 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -3596,21 +3593,21 @@ [5] len: count = 0 [6] payload: string = -1254722771.494167 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8685, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126800203, hl=20, dl=0, reserved=0, flags=16, win=14520], udp=, icmp=] -1254722771.494167 event_queue_flush_point -1254722771.494167 event_queue_flush_point -1254722771.494181 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9560, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126803107, ack=2934727550, hl=20, dl=1452, reserved=0, flags=24, win=65073], udp=, icmp=] -1254722771.494181 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from =\x0d\x0alinker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress =\x0d\x0awindow"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.2\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.1\x0d\x0a* "Build priority" per-unit\x0d\x0a* "Include file in linking process" per-unit\x0d\x0a* New feature: compile current file only\x0d\x0a* Separated C++ compiler options from C compiler options in Makefile =\x0d\x0a(see bug report #654744)\x0d\x0a* Separated C++ include dirs from C include dirs in Makefile (see bug =\x0d\x0areport #654744)\x0d\x0a* Necessary UI changes in Project Options\x0d\x0a* Added display of project filename, project output and a summary of the =\x0d\x0aproject files in Project Options General tab.\x0d\x0a* Fixed the "compiler-dirs-with-spaces" bug that crept-in in 4.9.7.0\x0d\x0a* Multi-select files in project-view (when "double-click to open" is =\x0d\x0aconfigured in Environment Settings)\x0d\x0a* Resource files are treated as ordinary files now\x0d\x0a* Updates in "Project Options/Files" code\x0d\x0a* MSVC import now creates the folders structure of the original VC =\x0d\x0aproject\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.0\x0d\x0a* Allow customizing of per-unit compile command in projects\x0d\x0a* Added two new macros: and \x0d\x0a* A -1254722771.494181 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 7411 @@ -3618,427 +3615,427 @@ [5] len: count = 1452 [6] payload: string = "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from =\x0d\x0alinker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress =\x0d\x0awindow"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.2\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.1\x0d\x0a* "Build priority" per-unit\x0d\x0a* "Include file in linking process" per-unit\x0d\x0a* New feature: compile current file only\x0d\x0a* Separated C++ compiler options from C compiler options in Makefile =\x0d\x0a(see bug report #654744)\x0d\x0a* Separated C++ include dirs from C include dirs in Makefile (see bug =\x0d\x0areport #654744)\x0d\x0a* Necessary UI changes in Project Options\x0d\x0a* Added display of project filename, project output and a summary of the =\x0d\x0aproject files in Project Options General tab.\x0d\x0a* Fixed the "compiler-dirs-with-spaces" bug that crept-in in 4.9.7.0\x0d\x0a* Multi-select files in project-view (when "double-click to open" is =\x0d\x0aconfigured in Environment Settings)\x0d\x0a* Resource files are treated as ordinary files now\x0d\x0a* Updates in "Project Options/Files" code\x0d\x0a* MSVC import now creates the folders structure of the original VC =\x0d\x0aproject\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.0\x0d\x0a* Allow customizing of per-unit compile command in projects\x0d\x0a* Added two new macros: and \x0d\x0a* A -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 27 [2] data: string = * Added "Classes" toolbar\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added "Classes" toolbar -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 61 [2] data: string = * Fixed pre-compilation dependency checks to work correctly\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Fixed pre-compilation dependency checks to work correctly -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 46 [2] data: string = * Added new file menu entry: Save Project As\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added new file menu entry: Save Project As -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 64 [2] data: string = * Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug-fix for double quotes in devcpp.cfg file read by vUpdate -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 19 [2] data: string = * Other bug fixes\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Other bug fixes -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.3\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.3 -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 68 [2] data: string = * When adding debugging symbols on request, remove "-s" option from -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * When adding debugging symbols on request, remove "-s" option from = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 8 [2] data: string = linker\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = linker -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 29 [2] data: string = * Compiling progress window\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Compiling progress window -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 72 [2] data: string = * Environment options : "Show progress window" and "Auto-close progress -1254722771.494181 file_sniff - [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=1254722771.494181, seen_bytes=4027, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress , info=[ts=1254722770.692804, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=, filename=NEWS.txt, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=4027, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress , info=[ts=XXXXXXXXXX.XXXXXX, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=, filename=NEWS.txt, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T] -1254722771.494181 event_queue_flush_point -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Environment options : "Show progress window" and "Auto-close progress = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = window"\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = window" -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.2\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.2 -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.1\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.1 -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 29 [2] data: string = * "Build priority" per-unit\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * "Build priority" per-unit -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 46 [2] data: string = * "Include file in linking process" per-unit\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * "Include file in linking process" per-unit -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 42 [2] data: string = * New feature: compile current file only\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New feature: compile current file only -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = * Separated C++ compiler options from C compiler options in Makefile -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Separated C++ compiler options from C compiler options in Makefile = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 26 [2] data: string = (see bug report #654744)\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = (see bug report #654744) -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = * Separated C++ include dirs from C include dirs in Makefile (see bug -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Separated C++ include dirs from C include dirs in Makefile (see bug = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = report #654744)\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = report #654744) -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 43 [2] data: string = * Necessary UI changes in Project Options\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Necessary UI changes in Project Options -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = * Added display of project filename, project output and a summary of the -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added display of project filename, project output and a summary of the = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 47 [2] data: string = project files in Project Options General tab.\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = project files in Project Options General tab. -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = * Fixed the "compiler-dirs-with-spaces" bug that crept-in in 4.9.7.0\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Fixed the "compiler-dirs-with-spaces" bug that crept-in in 4.9.7.0 -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = * Multi-select files in project-view (when "double-click to open" is -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Multi-select files in project-view (when "double-click to open" is = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 37 [2] data: string = configured in Environment Settings)\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = configured in Environment Settings) -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 52 [2] data: string = * Resource files are treated as ordinary files now\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Resource files are treated as ordinary files now -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 43 [2] data: string = * Updates in "Project Options/Files" code\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Updates in "Project Options/Files" code -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 67 [2] data: string = * MSVC import now creates the folders structure of the original VC -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * MSVC import now creates the folders structure of the original VC = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = project\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = project -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.7.0\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.7.0 -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 61 [2] data: string = * Allow customizing of per-unit compile command in projects\x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Allow customizing of per-unit compile command in projects -1254722771.494181 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 47 [2] data: string = * Added two new macros: and \x0d\x0a -1254722771.494181 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=8862, state=4, num_pkts=18, num_bytes_ip=13978, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 134.859085 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added two new macros: and -1254722771.494181 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1506, cap_len=1506, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9560, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126803107, ack=2934727550, hl=20, dl=1452, reserved=0, flags=24, win=65073], udp=, icmp=] -1254722771.494181 event_queue_flush_point -1254722771.494181 event_queue_flush_point -1254722771.494199 event_queue_flush_point -1254722771.494199 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9561, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126804559, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.494199 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = dded support for macros in the "default source code" (Tools/Editor =\x0d\x0aOptions/Code)\x0d\x0a* Separated layout info from project file. It is now kept in a different =\x0d\x0afile\x0d\x0a (the same filename as the project's but with extension ".layout"). If =\x0d\x0ayou\x0d\x0a have your project under CVS control, you ''ll know why this had to =\x0d\x0ahappen...\x0d\x0a* Compiler settings per-project\x0d\x0a* Compiler set per-project\x0d\x0a* Implemented new compiler settings framework\x0d\x0a* "Compile as C++" per-unit\x0d\x0a* "Include file in compilation process" per-unit\x0d\x0a* Project version info (creates the relevant VERSIONINFO struct in the =\x0d\x0aprivate\x0d\x0a resource)\x0d\x0a* Support XP Themes (creates the CommonControls 6.0 manifest file and =\x0d\x0aincludes\x0d\x0a it in the private resource)\x0d\x0a* Added CVS "login" and "logout" commands\x0d\x0a* Project manager and debugging window (in Debug tab) can now be =\x0d\x0atrasnformed into floating windows.\x0d\x0a* Added "Add Library" button in Project Options\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.9\x0d\x0a* Implemented search in help files for the word at cursor (context =\x0d\x0asensitive help)\x0d\x0a* Implemented "compiler sets" infrastructure to switch between different =\x0d\x0acompilers easily (e.g. gcc-2.95 and gcc-3.2)\x0d\x0a* Added "Files" tab in CVS form to allow selection of more than one file =\x0d\x0afor\x0d\x0a the requested CVS action\x0d\x0a =20\x0d\x0aVersion 4.9.6.8\x0d\x0a* support for DLL application hosting, for debugging and executing DLLs =\x0d\x0aunder Dev-C++.\x0d\x0a* New class browser option: "Show inherited members"\x0d\x0a* Added sup -1254722771.494199 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 8863 @@ -4046,402 +4043,402 @@ [5] len: count = 1452 [6] payload: string = dded support for macros in the "default source code" (Tools/Editor =\x0d\x0aOptions/Code)\x0d\x0a* Separated layout info from project file. It is now kept in a different =\x0d\x0afile\x0d\x0a (the same filename as the project's but with extension ".layout"). If =\x0d\x0ayou\x0d\x0a have your project under CVS control, you ''ll know why this had to =\x0d\x0ahappen...\x0d\x0a* Compiler settings per-project\x0d\x0a* Compiler set per-project\x0d\x0a* Implemented new compiler settings framework\x0d\x0a* "Compile as C++" per-unit\x0d\x0a* "Include file in compilation process" per-unit\x0d\x0a* Project version info (creates the relevant VERSIONINFO struct in the =\x0d\x0aprivate\x0d\x0a resource)\x0d\x0a* Support XP Themes (creates the CommonControls 6.0 manifest file and =\x0d\x0aincludes\x0d\x0a it in the private resource)\x0d\x0a* Added CVS "login" and "logout" commands\x0d\x0a* Project manager and debugging window (in Debug tab) can now be =\x0d\x0atrasnformed into floating windows.\x0d\x0a* Added "Add Library" button in Project Options\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.9\x0d\x0a* Implemented search in help files for the word at cursor (context =\x0d\x0asensitive help)\x0d\x0a* Implemented "compiler sets" infrastructure to switch between different =\x0d\x0acompilers easily (e.g. gcc-2.95 and gcc-3.2)\x0d\x0a* Added "Files" tab in CVS form to allow selection of more than one file =\x0d\x0afor\x0d\x0a the requested CVS action\x0d\x0a =20\x0d\x0aVersion 4.9.6.8\x0d\x0a* support for DLL application hosting, for debugging and executing DLLs =\x0d\x0aunder Dev-C++.\x0d\x0a* New class browser option: "Show inherited members"\x0d\x0a* Added sup -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = * Added support for macros in the "default source code" (Tools/Editor -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added support for macros in the "default source code" (Tools/Editor = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 15 [2] data: string = Options/Code)\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Options/Code) -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = * Separated layout info from project file. It is now kept in a different -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Separated layout info from project file. It is now kept in a different = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 6 [2] data: string = file\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = file -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 72 [2] data: string = (the same filename as the project's but with extension ".layout"). If -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = (the same filename as the project's but with extension ".layout"). If = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 5 [2] data: string = you\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = you -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = have your project under CVS control, you ''ll know why this had to -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = have your project under CVS control, you ''ll know why this had to = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 11 [2] data: string = happen...\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = happen... -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 33 [2] data: string = * Compiler settings per-project\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Compiler settings per-project -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 28 [2] data: string = * Compiler set per-project\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Compiler set per-project -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 47 [2] data: string = * Implemented new compiler settings framework\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Implemented new compiler settings framework -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 29 [2] data: string = * "Compile as C++" per-unit\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * "Compile as C++" per-unit -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 50 [2] data: string = * "Include file in compilation process" per-unit\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * "Include file in compilation process" per-unit -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = * Project version info (creates the relevant VERSIONINFO struct in the -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Project version info (creates the relevant VERSIONINFO struct in the = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = private\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = private -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = resource)\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = resource) -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = * Support XP Themes (creates the CommonControls 6.0 manifest file and -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Support XP Themes (creates the CommonControls 6.0 manifest file and = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 10 [2] data: string = includes\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = includes -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 31 [2] data: string = it in the private resource)\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = it in the private resource) -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 43 [2] data: string = * Added CVS "login" and "logout" commands\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added CVS "login" and "logout" commands -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 65 [2] data: string = * Project manager and debugging window (in Debug tab) can now be -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Project manager and debugging window (in Debug tab) can now be = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 36 [2] data: string = trasnformed into floating windows.\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = trasnformed into floating windows. -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 49 [2] data: string = * Added "Add Library" button in Project Options\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added "Add Library" button in Project Options -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.6.9\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.6.9 -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 67 [2] data: string = * Implemented search in help files for the word at cursor (context -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Implemented search in help files for the word at cursor (context = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = sensitive help)\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = sensitive help) -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = * Implemented "compiler sets" infrastructure to switch between different -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Implemented "compiler sets" infrastructure to switch between different = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 46 [2] data: string = compilers easily (e.g. gcc-2.95 and gcc-3.2)\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = compilers easily (e.g. gcc-2.95 and gcc-3.2) -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = * Added "Files" tab in CVS form to allow selection of more than one file -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added "Files" tab in CVS form to allow selection of more than one file = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 5 [2] data: string = for\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = for -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 28 [2] data: string = the requested CVS action\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = the requested CVS action -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 4 [2] data: string = \x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = =20 -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.6.8\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.6.8 -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 72 [2] data: string = * support for DLL application hosting, for debugging and executing DLLs -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * support for DLL application hosting, for debugging and executing DLLs = -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 16 [2] data: string = under Dev-C++.\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = under Dev-C++. -1254722771.494199 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 54 [2] data: string = * New class browser option: "Show inherited members"\x0d\x0a -1254722771.494199 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=19, num_bytes_ip=15470, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 965.0 msecs 152.978897 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New class browser option: "Show inherited members" -1254722771.494199 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1506, cap_len=1506, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9561, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126804559, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.494199 event_queue_flush_point -1254722771.494199 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722771.494199 event_queue_flush_point -1254722771.834595 Broker::log_flush -1254722771.834595 event_queue_flush_point -1254722771.834595 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 548.906326 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 548.906326 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8686, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126801655, hl=20, dl=0, reserved=0, flags=16, win=17424], udp=, icmp=] -1254722771.834595 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 548.906326 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=10314, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=13, num_bytes_ip=990, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 548.906326 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -4449,24 +4446,24 @@ [5] len: count = 0 [6] payload: string = -1254722771.834595 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8686, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126801655, hl=20, dl=0, reserved=0, flags=16, win=17424], udp=, icmp=] -1254722771.834595 event_queue_flush_point -1254722771.834595 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722771.834595 event_queue_flush_point -1254722771.834628 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9562, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126806011, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.834628 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = port for the '::' member access operator in code-completion\x0d\x0a* Added *working* function arguments hint\x0d\x0a* Added bracket highlighting. When the caret is on a bracket, that =\x0d\x0abracket and\x0d\x0a its counterpart are highlighted\x0d\x0a* Nested folders in project view\x0d\x0a\x0d\x0aVersion 4.9.6.7\x0d\x0a* XP Theme support\x0d\x0a* Added CVS commands "Add" and "Remove"\x0d\x0a* Added configuration option for "Templates Directory" in "Environment =\x0d\x0aOptions"\x0d\x0a* Code-completion updates\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.6\x0d\x0a* Editor colors are initialized properly on Dev-C++ first-run\x0d\x0a* Added doxygen-style comments in NewClass, NewMemberFunction and =\x0d\x0aNewMemberVariable wizards\x0d\x0a* Added file's date/time stamp in File/Properties window\x0d\x0a* Current windows listing in Window menu\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.5\x0d\x0a* CVS support\x0d\x0a* Window list (in Window menu)\x0d\x0a* bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.4\x0d\x0a* added ENTER key for opening file in project browser, DEL to delete =\x0d\x0afrom the project.\x0d\x0a* bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.3\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.2\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.1\x0d\x0a* New "Abort compilation" button\x0d\x0a* Bug fixes\x0d\x0a* Now checks for vRoach existance when sending a crash report\x0d\x0a\x0d\x0aVersion 4.9.5.5\x0d\x0a* New option in Editor Options: Show editor hints. User can disable the =\x0d\x0ahints\x0d\x0a displayed in the editor when the mouse moves over a word. Since this =\x0d\x0awas the\x0d\x0a cause of many errors (although it should be fixed by now), we are =\x0d\x0agiving the\x0d\x0a user the option to disable this featu -1254722771.834628 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 10315 @@ -4474,531 +4471,531 @@ [5] len: count = 1452 [6] payload: string = port for the '::' member access operator in code-completion\x0d\x0a* Added *working* function arguments hint\x0d\x0a* Added bracket highlighting. When the caret is on a bracket, that =\x0d\x0abracket and\x0d\x0a its counterpart are highlighted\x0d\x0a* Nested folders in project view\x0d\x0a\x0d\x0aVersion 4.9.6.7\x0d\x0a* XP Theme support\x0d\x0a* Added CVS commands "Add" and "Remove"\x0d\x0a* Added configuration option for "Templates Directory" in "Environment =\x0d\x0aOptions"\x0d\x0a* Code-completion updates\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.6\x0d\x0a* Editor colors are initialized properly on Dev-C++ first-run\x0d\x0a* Added doxygen-style comments in NewClass, NewMemberFunction and =\x0d\x0aNewMemberVariable wizards\x0d\x0a* Added file's date/time stamp in File/Properties window\x0d\x0a* Current windows listing in Window menu\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.5\x0d\x0a* CVS support\x0d\x0a* Window list (in Window menu)\x0d\x0a* bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.4\x0d\x0a* added ENTER key for opening file in project browser, DEL to delete =\x0d\x0afrom the project.\x0d\x0a* bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.3\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.2\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.1\x0d\x0a* New "Abort compilation" button\x0d\x0a* Bug fixes\x0d\x0a* Now checks for vRoach existance when sending a crash report\x0d\x0a\x0d\x0aVersion 4.9.5.5\x0d\x0a* New option in Editor Options: Show editor hints. User can disable the =\x0d\x0ahints\x0d\x0a displayed in the editor when the mouse moves over a word. Since this =\x0d\x0awas the\x0d\x0a cause of many errors (although it should be fixed by now), we are =\x0d\x0agiving the\x0d\x0a user the option to disable this featu -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 72 [2] data: string = * Added support for the '::' member access operator in code-completion\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added support for the '::' member access operator in code-completion -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 43 [2] data: string = * Added *working* function arguments hint\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added *working* function arguments hint -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 67 [2] data: string = * Added bracket highlighting. When the caret is on a bracket, that -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added bracket highlighting. When the caret is on a bracket, that = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = bracket and\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = bracket and -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 35 [2] data: string = its counterpart are highlighted\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = its counterpart are highlighted -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 34 [2] data: string = * Nested folders in project view\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Nested folders in project view -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.6.7\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.6.7 -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 20 [2] data: string = * XP Theme support\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * XP Theme support -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 41 [2] data: string = * Added CVS commands "Add" and "Remove"\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added CVS commands "Add" and "Remove" -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = * Added configuration option for "Templates Directory" in "Environment -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added configuration option for "Templates Directory" in "Environment = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 10 [2] data: string = Options"\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Options" -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 27 [2] data: string = * Code-completion updates\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Code-completion updates -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.6.6\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.6.6 -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 63 [2] data: string = * Editor colors are initialized properly on Dev-C++ first-run\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Editor colors are initialized properly on Dev-C++ first-run -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 66 [2] data: string = * Added doxygen-style comments in NewClass, NewMemberFunction and -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added doxygen-style comments in NewClass, NewMemberFunction and = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 27 [2] data: string = NewMemberVariable wizards\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = NewMemberVariable wizards -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 58 [2] data: string = * Added file's date/time stamp in File/Properties window\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added file's date/time stamp in File/Properties window -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 42 [2] data: string = * Current windows listing in Window menu\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Current windows listing in Window menu -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.6.5\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.6.5 -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 15 [2] data: string = * CVS support\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * CVS support -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 32 [2] data: string = * Window list (in Window menu)\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Window list (in Window menu) -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * bug fixes\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * bug fixes -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = version 4.9.6.4\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = version 4.9.6.4 -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = * added ENTER key for opening file in project browser, DEL to delete -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * added ENTER key for opening file in project browser, DEL to delete = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 19 [2] data: string = from the project.\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = from the project. -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * bug fixes\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * bug fixes -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = version 4.9.6.3\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = version 4.9.6.3 -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = version 4.9.6.2\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = version 4.9.6.2 -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = version 4.9.6.1\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = version 4.9.6.1 -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 34 [2] data: string = * New "Abort compilation" button\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New "Abort compilation" button -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 13 [2] data: string = * Bug fixes\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Bug fixes -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 63 [2] data: string = * Now checks for vRoach existance when sending a crash report\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Now checks for vRoach existance when sending a crash report -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.5.5\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.5.5 -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 72 [2] data: string = * New option in Editor Options: Show editor hints. User can disable the -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New option in Editor Options: Show editor hints. User can disable the = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 7 [2] data: string = hints\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = hints -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = displayed in the editor when the mouse moves over a word. Since this -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = displayed in the editor when the mouse moves over a word. Since this = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = was the\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = was the -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 68 [2] data: string = cause of many errors (although it should be fixed by now), we are -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = cause of many errors (although it should be fixed by now), we are = -1254722771.834628 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 12 [2] data: string = giving the\x0d\x0a -1254722771.834628 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=11766, state=4, num_pkts=20, num_bytes_ip=16962, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 582.046509 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = giving the -1254722771.834628 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1506, cap_len=1506, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9562, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126806011, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.834628 event_queue_flush_point -1254722771.834628 event_queue_flush_point -1254722771.834655 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9563, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126807463, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.834655 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = re.\x0d\x0a* New option in Editor Options (code-completion): Use code-completion =\x0d\x0acache.\x0d\x0a Well, it adds caching to code-completion. Depending on the cache size,\x0d\x0a the program may take a bit longer to start-up, but provides very fast\x0d\x0a code-completion and the user has all the commands (belonging to the =\x0d\x0afiles\x0d\x0a he added in the cache) at his fingertips. If, for example, the user =\x0d\x0aadds\x0d\x0a "windows.h", he gets all the WinAPI! If he adds "wx/wx.h", he gets all =\x0d\x0aof\x0d\x0a wxWindows! You get the picture...\x0d\x0a* Removed "Only show classes from current file" option in class browser =\x0d\x0asettings.\x0d\x0a It used to be a checkbox, allowing only two states (on or off), but =\x0d\x0athere is\x0d\x0a a third relevant option now: "Project classes" so it didn't fit the =\x0d\x0apurpose...\x0d\x0a The user can define this in the class browser's context menu under =\x0d\x0a"View mode".\x0d\x0a* Fixed the dreaded "Clock skew detected" compiler warning!\x0d\x0a* Fixed many class browser bugs, including some that had to do with =\x0d\x0aclass folders.\x0d\x0a\x0d\x0aVersion 4.9.5.4\x0d\x0a* Under NT, 2000 and XP, user application data directory will be used to =\x0d\x0astore config files (i.e : C:\Documents and Settings\Username\Local =\x0d\x0aSettings\Application Data)\x0d\x0a\x0d\x0aVersion 4.9.5.3\x0d\x0a* Added ExceptionsAnalyzer. If the devcpp.map file is in the devcpp.exe =\x0d\x0adirectory\x0d\x0a then we even get a stack trace in the bug report!\x0d\x0a* Added new WebUpdate module (inactive temporarily).\x0d\x0a* Added new code for code-completion caching of fi -1254722771.834655 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 11767 @@ -5006,357 +5003,357 @@ [5] len: count = 1452 [6] payload: string = re.\x0d\x0a* New option in Editor Options (code-completion): Use code-completion =\x0d\x0acache.\x0d\x0a Well, it adds caching to code-completion. Depending on the cache size,\x0d\x0a the program may take a bit longer to start-up, but provides very fast\x0d\x0a code-completion and the user has all the commands (belonging to the =\x0d\x0afiles\x0d\x0a he added in the cache) at his fingertips. If, for example, the user =\x0d\x0aadds\x0d\x0a "windows.h", he gets all the WinAPI! If he adds "wx/wx.h", he gets all =\x0d\x0aof\x0d\x0a wxWindows! You get the picture...\x0d\x0a* Removed "Only show classes from current file" option in class browser =\x0d\x0asettings.\x0d\x0a It used to be a checkbox, allowing only two states (on or off), but =\x0d\x0athere is\x0d\x0a a third relevant option now: "Project classes" so it didn't fit the =\x0d\x0apurpose...\x0d\x0a The user can define this in the class browser's context menu under =\x0d\x0a"View mode".\x0d\x0a* Fixed the dreaded "Clock skew detected" compiler warning!\x0d\x0a* Fixed many class browser bugs, including some that had to do with =\x0d\x0aclass folders.\x0d\x0a\x0d\x0aVersion 4.9.5.4\x0d\x0a* Under NT, 2000 and XP, user application data directory will be used to =\x0d\x0astore config files (i.e : C:\Documents and Settings\Username\Local =\x0d\x0aSettings\Application Data)\x0d\x0a\x0d\x0aVersion 4.9.5.3\x0d\x0a* Added ExceptionsAnalyzer. If the devcpp.map file is in the devcpp.exe =\x0d\x0adirectory\x0d\x0a then we even get a stack trace in the bug report!\x0d\x0a* Added new WebUpdate module (inactive temporarily).\x0d\x0a* Added new code for code-completion caching of fi -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 44 [2] data: string = user the option to disable this feature.\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = user the option to disable this feature. -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = * New option in Editor Options (code-completion): Use code-completion -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New option in Editor Options (code-completion): Use code-completion = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 8 [2] data: string = cache.\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = cache. -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 74 [2] data: string = Well, it adds caching to code-completion. Depending on the cache size,\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Well, it adds caching to code-completion. Depending on the cache size, -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = the program may take a bit longer to start-up, but provides very fast\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = the program may take a bit longer to start-up, but provides very fast -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = code-completion and the user has all the commands (belonging to the -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = code-completion and the user has all the commands (belonging to the = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 7 [2] data: string = files\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = files -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = he added in the cache) at his fingertips. If, for example, the user -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = he added in the cache) at his fingertips. If, for example, the user = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 6 [2] data: string = adds\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = adds -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = "windows.h", he gets all the WinAPI! If he adds "wx/wx.h", he gets all -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = "windows.h", he gets all the WinAPI! If he adds "wx/wx.h", he gets all = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 4 [2] data: string = of\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = of -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 37 [2] data: string = wxWindows! You get the picture...\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = wxWindows! You get the picture... -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 72 [2] data: string = * Removed "Only show classes from current file" option in class browser -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Removed "Only show classes from current file" option in class browser = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 11 [2] data: string = settings.\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = settings. -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = It used to be a checkbox, allowing only two states (on or off), but -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = It used to be a checkbox, allowing only two states (on or off), but = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 10 [2] data: string = there is\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = there is -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 70 [2] data: string = a third relevant option now: "Project classes" so it didn't fit the -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = a third relevant option now: "Project classes" so it didn't fit the = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 12 [2] data: string = purpose...\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = purpose... -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = The user can define this in the class browser's context menu under -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = The user can define this in the class browser's context menu under = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 14 [2] data: string = "View mode".\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = "View mode". -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 61 [2] data: string = * Fixed the dreaded "Clock skew detected" compiler warning!\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Fixed the dreaded "Clock skew detected" compiler warning! -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 68 [2] data: string = * Fixed many class browser bugs, including some that had to do with -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Fixed many class browser bugs, including some that had to do with = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 16 [2] data: string = class folders.\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = class folders. -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.5.4\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.5.4 -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = * Under NT, 2000 and XP, user application data directory will be used to -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Under NT, 2000 and XP, user application data directory will be used to = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 67 [2] data: string = store config files (i.e : C:\Documents and Settings\Username\Local -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = store config files (i.e : C:\Documents and Settings\Username\Local = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 28 [2] data: string = Settings\Application Data)\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Settings\Application Data) -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.5.3\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.5.3 -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 72 [2] data: string = * Added ExceptionsAnalyzer. If the devcpp.map file is in the devcpp.exe -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added ExceptionsAnalyzer. If the devcpp.map file is in the devcpp.exe = -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 11 [2] data: string = directory\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = directory -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 53 [2] data: string = then we even get a stack trace in the bug report!\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = then we even get a stack trace in the bug report! -1254722771.834655 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 54 [2] data: string = * Added new WebUpdate module (inactive temporarily).\x0d\x0a -1254722771.834655 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=21, num_bytes_ip=18454, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 305.0 msecs 608.987808 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added new WebUpdate module (inactive temporarily). -1254722771.834655 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1506, cap_len=1506, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9563, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126807463, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.834655 event_queue_flush_point -1254722771.834655 event_queue_flush_point -1254722771.858301 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 254.865646 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 254.865646 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8687, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126803107, hl=20, dl=0, reserved=0, flags=16, win=20328], udp=, icmp=] -1254722771.858301 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 254.865646 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=13218, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=14, num_bytes_ip=1030, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 254.865646 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -5364,21 +5361,21 @@ [5] len: count = 0 [6] payload: string = -1254722771.858301 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8687, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126803107, hl=20, dl=0, reserved=0, flags=16, win=20328], udp=, icmp=] -1254722771.858301 event_queue_flush_point -1254722771.858301 event_queue_flush_point -1254722771.858316 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1492, id=9564, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126808915, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.858316 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = les (disabled - work =\x0d\x0ain progress).\x0d\x0a\x0d\x0aVersion 4.9.5.2\x0d\x0a* Added new option in class-browser: Use colors\x0d\x0a (available when right-clicking the class-browser\x0d\x0a and selecting "View mode").\x0d\x0a* Dev-C++ now traps access violation of your programs (and of itself too =\x0d\x0a;)\x0d\x0a\x0d\x0aVersion 4.9.5.1\x0d\x0a* Implemented the "File/Export/Project to HTML" function.\x0d\x0a* Added "Tip of the day" system.\x0d\x0a* When running a source file in explorer, don't spawn new instance.\x0d\x0a Instead open the file in an already launched Dev-C++.\x0d\x0a* Class-parser speed-up (50% to 85% improvement timed!!!)\x0d\x0a* Many code-completion updates. Now takes into account context,\x0d\x0a class inheritance and visibility (shows items only from files\x0d\x0a #included directly or indirectly)!\x0d\x0a* Caching of result set of code-completion for speed-up.\x0d\x0a* New option "Execution/Parameters" (and "Debug/Parameters").\x0d\x0a\x0d\x0aVersion 4.9.5.0 (5.0 beta 5):\x0d\x0a* CPU Window (still in development)\x0d\x0a* ToDo list\x0d\x0a* Backtrace in debugging\x0d\x0a* Run to cursor\x0d\x0a* Folders in Project and Class Browser\x0d\x0a* Send custom commands to GDB\x0d\x0a* Makefile can now be customized.\x0d\x0a* Modified the behaviour of the -c param :=20\x0d\x0a -c \x0d\x0a* Saving of custom syntax parameter group\x0d\x0a* Possibility of changing compilers and tools filename.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0a\x0d\x0aVersion 4.9.4.1 (5.0 beta 4.1):\x0d\x0a\x0d\x0a* back to gcc 2.95.3\x0d\x0a* Profiling support\x0d\x0a* new update/packages checker (vUpdate)\x0d\x0a* Lots of bugfixes\x0d\x0a\x0d\x0a------=_NextPart_000_00 -1254722771.858316 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 13219 @@ -5386,461 +5383,461 @@ [5] len: count = 1452 [6] payload: string = les (disabled - work =\x0d\x0ain progress).\x0d\x0a\x0d\x0aVersion 4.9.5.2\x0d\x0a* Added new option in class-browser: Use colors\x0d\x0a (available when right-clicking the class-browser\x0d\x0a and selecting "View mode").\x0d\x0a* Dev-C++ now traps access violation of your programs (and of itself too =\x0d\x0a;)\x0d\x0a\x0d\x0aVersion 4.9.5.1\x0d\x0a* Implemented the "File/Export/Project to HTML" function.\x0d\x0a* Added "Tip of the day" system.\x0d\x0a* When running a source file in explorer, don't spawn new instance.\x0d\x0a Instead open the file in an already launched Dev-C++.\x0d\x0a* Class-parser speed-up (50% to 85% improvement timed!!!)\x0d\x0a* Many code-completion updates. Now takes into account context,\x0d\x0a class inheritance and visibility (shows items only from files\x0d\x0a #included directly or indirectly)!\x0d\x0a* Caching of result set of code-completion for speed-up.\x0d\x0a* New option "Execution/Parameters" (and "Debug/Parameters").\x0d\x0a\x0d\x0aVersion 4.9.5.0 (5.0 beta 5):\x0d\x0a* CPU Window (still in development)\x0d\x0a* ToDo list\x0d\x0a* Backtrace in debugging\x0d\x0a* Run to cursor\x0d\x0a* Folders in Project and Class Browser\x0d\x0a* Send custom commands to GDB\x0d\x0a* Makefile can now be customized.\x0d\x0a* Modified the behaviour of the -c param :=20\x0d\x0a -c \x0d\x0a* Saving of custom syntax parameter group\x0d\x0a* Possibility of changing compilers and tools filename.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0a\x0d\x0aVersion 4.9.4.1 (5.0 beta 4.1):\x0d\x0a\x0d\x0a* back to gcc 2.95.3\x0d\x0a* Profiling support\x0d\x0a* new update/packages checker (vUpdate)\x0d\x0a* Lots of bugfixes\x0d\x0a\x0d\x0a------=_NextPart_000_00 -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 71 [2] data: string = * Added new code for code-completion caching of files (disabled - work -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added new code for code-completion caching of files (disabled - work = -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 15 [2] data: string = in progress).\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = in progress). -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.5.2\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.5.2 -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 49 [2] data: string = * Added new option in class-browser: Use colors\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added new option in class-browser: Use colors -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 52 [2] data: string = (available when right-clicking the class-browser\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = (available when right-clicking the class-browser -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 31 [2] data: string = and selecting "View mode").\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = and selecting "View mode"). -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 73 [2] data: string = * Dev-C++ now traps access violation of your programs (and of itself too -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Dev-C++ now traps access violation of your programs (and of itself too = -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 4 [2] data: string = ;)\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = ;) -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = Version 4.9.5.1\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.5.1 -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 59 [2] data: string = * Implemented the "File/Export/Project to HTML" function.\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Implemented the "File/Export/Project to HTML" function. -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 34 [2] data: string = * Added "Tip of the day" system.\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Added "Tip of the day" system. -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 69 [2] data: string = * When running a source file in explorer, don't spawn new instance.\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * When running a source file in explorer, don't spawn new instance. -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 57 [2] data: string = Instead open the file in an already launched Dev-C++.\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Instead open the file in an already launched Dev-C++. -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 59 [2] data: string = * Class-parser speed-up (50% to 85% improvement timed!!!)\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Class-parser speed-up (50% to 85% improvement timed!!!) -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 65 [2] data: string = * Many code-completion updates. Now takes into account context,\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Many code-completion updates. Now takes into account context, -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 65 [2] data: string = class inheritance and visibility (shows items only from files\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = class inheritance and visibility (shows items only from files -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 38 [2] data: string = #included directly or indirectly)!\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = #included directly or indirectly)! -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 58 [2] data: string = * Caching of result set of code-completion for speed-up.\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Caching of result set of code-completion for speed-up. -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 63 [2] data: string = * New option "Execution/Parameters" (and "Debug/Parameters").\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * New option "Execution/Parameters" (and "Debug/Parameters"). -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 31 [2] data: string = Version 4.9.5.0 (5.0 beta 5):\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.5.0 (5.0 beta 5): -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 37 [2] data: string = * CPU Window (still in development)\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * CPU Window (still in development) -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 14 [2] data: string = * ToDo list\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * ToDo list -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 26 [2] data: string = * Backtrace in debugging\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Backtrace in debugging -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 17 [2] data: string = * Run to cursor\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Run to cursor -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 40 [2] data: string = * Folders in Project and Class Browser\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Folders in Project and Class Browser -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 31 [2] data: string = * Send custom commands to GDB\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Send custom commands to GDB -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 35 [2] data: string = * Makefile can now be customized.\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Makefile can now be customized. -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 45 [2] data: string = * Modified the behaviour of the -c param : \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Modified the behaviour of the -c param :=20 -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 30 [2] data: string = -c \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -c -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 43 [2] data: string = * Saving of custom syntax parameter group\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Saving of custom syntax parameter group -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 57 [2] data: string = * Possibility of changing compilers and tools filename.\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Possibility of changing compilers and tools filename. -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 18 [2] data: string = * Many bug fixes\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Many bug fixes -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 33 [2] data: string = Version 4.9.4.1 (5.0 beta 4.1):\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Version 4.9.4.1 (5.0 beta 4.1): -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 22 [2] data: string = * back to gcc 2.95.3\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * back to gcc 2.95.3 -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 21 [2] data: string = * Profiling support\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Profiling support -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 41 [2] data: string = * new update/packages checker (vUpdate)\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * new update/packages checker (vUpdate) -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 20 [2] data: string = * Lots of bugfixes\x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = * Lots of bugfixes -1254722771.858316 mime_segment_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1254722771.858316 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14670, state=4, num_pkts=22, num_bytes_ip=19946, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 269.886017 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.858316 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1506, cap_len=1506, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1492, id=9564, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126808915, ack=2934727550, hl=20, dl=1452, reserved=0, flags=16, win=65073], udp=, icmp=] -1254722771.858316 event_queue_flush_point -1254722771.858316 event_queue_flush_point -1254722771.858334 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=69, id=9565, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810367, ack=2934727550, hl=20, dl=29, reserved=0, flags=24, win=65073], udp=, icmp=] -1254722771.858334 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = 04_01CA45B0.095693F0--\x0d\x0a\x0d\x0a.\x0d\x0a -1254722771.858334 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 14671 @@ -5848,101 +5845,101 @@ [5] len: count = 29 [6] payload: string = 04_01CA45B0.095693F0--\x0d\x0a\x0d\x0a.\x0d\x0a -1254722771.858334 mime_entity_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_entity_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 10809 [2] data: string = Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress window"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.2\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.1\x0d\x0a* "Build priority" per-unit\x0d\x0a* "Include file in linking process" per-unit\x0d\x0a* New feature: compile current file only\x0d\x0a* Separated C++ compiler options from C compiler options in Makefile (see bug report #654744)\x0d\x0a* Separated C++ include dirs from C include dirs in Makefile (see bug report #654744)\x0d\x0a* Necessary UI changes in Project Options\x0d\x0a* Added display of project filename, project output and a summary of the project files in Project Options General tab.\x0d\x0a* Fixed the "compiler-dirs-with-spaces" bug that crept-in in 4.9.7.0\x0d\x0a* Multi-select files in project-view (when "double-click to open" is configured in Environment Settings)\x0d\x0a* Resource files are treated as ordinary files now\x0d\x0a* Updates in "Project Options/Files" code\x0d\x0a* MSVC import now creates the folders structure of the original VC project\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.0\x0d\x0a* Allow customizing of per-unit compile command in projects\x0d\x0a* Added two new macros: and \x0d\x0a* Added support for macros in the "default source code" (Tools/Editor Options/Code)\x0d\x0a* Separated layout info from project file. It is now kept in a different file\x0d\x0a (the same filename as the project's but with extension ".layout"). If you\x0d\x0a have your project under CVS control, you ''ll know why this had to happen...\x0d\x0a* Compiler settings per-project\x0d\x0a* Compiler set per-project\x0d\x0a* Implemented new compiler settings framework\x0d\x0a* "Compile as C++" per-unit\x0d\x0a* "Include file in compilation process" per-unit\x0d\x0a* Project version info (creates the relevant VERSIONINFO struct in the private\x0d\x0a resource)\x0d\x0a* Support XP Themes (creates the CommonControls 6.0 manifest file and includes\x0d\x0a it in the private resource)\x0d\x0a* Added CVS "login" and "logout" commands\x0d\x0a* Project manager and debugging window (in Debug tab) can now be trasnformed into floating windows.\x0d\x0a* Added "Add Library" button in Project Options\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.9\x0d\x0a* Implemented search in help files for the word at cursor (context sensitive help)\x0d\x0a* Implemented "compiler sets" infrastructure to switch between different compilers easily (e.g. gcc-2.95 and gcc-3.2)\x0d\x0a* Added "Files" tab in CVS form to allow selection of more than one file for\x0d\x0a the requested CVS action\x0d\x0a \x0d\x0aVersion 4.9.6.8\x0d\x0a* support for DLL application hosting, for debugging and executing DLLs under Dev-C++.\x0d\x0a* New class browser option: "Show inherited members"\x0d\x0a* Added support for the '::' member access operator in code-completion\x0d\x0a* Added *working* function arguments hint\x0d\x0a* Added bracket highlighting. When the caret is on a bracket, that bracket and\x0d\x0a its counterpart are highlighted\x0d\x0a* Nested folders in project view\x0d\x0a\x0d\x0aVersion 4.9.6.7\x0d\x0a* XP Theme support\x0d\x0a* Added CVS commands "Add" and "Remove"\x0d\x0a* Added configuration option for "Templates Directory" in "Environment Options"\x0d\x0a* Code-completion updates\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.6\x0d\x0a* Editor colors are initialized properly on Dev-C++ first-run\x0d\x0a* Added doxygen-style comments in NewClass, NewMemberFunction and NewMemberVariable wizards\x0d\x0a* Added file's date/time stamp in File/Properties window\x0d\x0a* Current windows listing in Window menu\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.5\x0d\x0a* CVS support\x0d\x0a* Window list (in Window menu)\x0d\x0a* bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.4\x0d\x0a* added ENTER key for opening file in project browser, DEL to delete from the project.\x0d\x0a* bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.3\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.2\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.1\x0d\x0a* New "Abort compilation" button\x0d\x0a* Bug fixes\x0d\x0a* Now checks for vRoach existance when sending a crash report\x0d\x0a\x0d\x0aVersion 4.9.5.5\x0d\x0a* New option in Editor Options: Show editor hints. User can disable the hints\x0d\x0a displayed in the editor when the mouse moves over a word. Since this was the\x0d\x0a cause of many errors (although it should be fixed by now), we are giving the\x0d\x0a user the option to disable this feature.\x0d\x0a* New option in Editor Options (code-completion): Use code-completion cache.\x0d\x0a Well, it adds caching to code-completion. Depending on the cache size,\x0d\x0a the program may take a bit longer to start-up, but provides very fast\x0d\x0a code-completion and the user has all the commands (belonging to the files\x0d\x0a he added in the cache) at his fingertips. If, for example, the user adds\x0d\x0a "windows.h", he gets all the WinAPI! If he adds "wx/wx.h", he gets all of\x0d\x0a wxWindows! You get the picture...\x0d\x0a* Removed "Only show classes from current file" option in class browser settings.\x0d\x0a It used to be a checkbox, allowing only two states (on or off), but there is\x0d\x0a a third relevant option now: "Project classes" so it didn't fit the purpose...\x0d\x0a The user can define this in the class browser's context menu under "View mode".\x0d\x0a* Fixed the dreaded "Clock skew detected" compiler warning!\x0d\x0a* Fixed many class browser bugs, including some that had to do with class folders.\x0d\x0a\x0d\x0aVersion 4.9.5.4\x0d\x0a* Under NT, 2000 and XP, user application data directory will be used to store config files (i.e : C:\Documents and Settings\Username\Local Settings\Application Data)\x0d\x0a\x0d\x0aVersion 4.9.5.3\x0d\x0a* Added ExceptionsAnalyzer. If the devcpp.map file is in the devcpp.exe directory\x0d\x0a then we even get a stack trace in the bug report!\x0d\x0a* Added new WebUpdate module (inactive temporarily).\x0d\x0a* Added new code for code-completion caching of files (disabled - work in progress).\x0d\x0a\x0d\x0aVersion 4.9.5.2\x0d\x0a* Added new option in class-browser: Use colors\x0d\x0a (available when right-clicking the class-browser\x0d\x0a and selecting "View mode").\x0d\x0a* Dev-C++ now traps access violation of your programs (and of itself too ;)\x0d\x0a\x0d\x0aVersion 4.9.5.1\x0d\x0a* Implemented the "File/Export/Project to HTML" function.\x0d\x0a* Added "Tip of the day" system.\x0d\x0a* When running a source file in explorer, don't spawn new instance.\x0d\x0a Instead open the file in an already launched Dev-C++.\x0d\x0a* Class-parser speed-up (50% to 85% improvement timed!!!)\x0d\x0a* Many code-completion updates. Now takes into account context,\x0d\x0a class inheritance and visibility (shows items only from files\x0d\x0a #included directly or indirectly)!\x0d\x0a* Caching of result set of code-completion for speed-up.\x0d\x0a* New option "Execution/Parameters" (and "Debug/Parameters").\x0d\x0a\x0d\x0aVersion 4.9.5.0 (5.0 beta 5):\x0d\x0a* CPU Window (still in development)\x0d\x0a* ToDo list\x0d\x0a* Backtrace in debugging\x0d\x0a* Run to cursor\x0d\x0a* Folders in Project and Class Browser\x0d\x0a* Send custom commands to GDB\x0d\x0a* Makefile can now be customized.\x0d\x0a* Modified the behaviour of the -c param : \x0d\x0a -c \x0d\x0a* Saving of custom syntax parameter group\x0d\x0a* Possibility of changing compilers and tools filename.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0a\x0d\x0aVersion 4.9.4.1 (5.0 beta 4.1):\x0d\x0a\x0d\x0a* back to gcc 2.95.3\x0d\x0a* Profiling support\x0d\x0a* new update/packages checker (vUpdate)\x0d\x0a* Lots of bugfixes\x0d\x0a\x0d\x0a -1254722771.858334 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=[filename=NEWS.txt], fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722771.858334 event_queue_flush_point -1254722771.858334 file_state_remove - [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=1254722771.858316, seen_bytes=10809, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress , info=[ts=1254722770.692804, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=text/plain, filename=NEWS.txt, duration=801.0 msecs 376.819611 usecs, local_orig=, is_orig=T, seen_bytes=4027, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=FEFYSd1s8Onn9LynKj, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp]] = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a\x09}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a\x09}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=10809, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=Version 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress , info=[ts=XXXXXXXXXX.XXXXXX, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=text/plain, filename=NEWS.txt, duration=801.0 msecs 376.819611 usecs, local_orig=, is_orig=T, seen_bytes=4027, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722771.858334 event_queue_flush_point -1254722771.858334 Files::log_files - [0] rec: Files::Info = [ts=1254722770.692804, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=text/plain, filename=NEWS.txt, duration=1.0 sec 165.0 msecs 511.846542 usecs, local_orig=, is_orig=T, seen_bytes=10809, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Files::log_files + [0] rec: Files::Info = [ts=XXXXXXXXXX.XXXXXX, fuid=FEFYSd1s8Onn9LynKj, tx_hosts={\x0a\x0910.10.1.4\x0a}, rx_hosts={\x0a\x0974.53.140.153\x0a}, conn_uids={\x0aClEkJM2Vm5giqnMf4h\x0a}, source=SMTP, depth=5, analyzers={\x0a\x0a}, mime_type=text/plain, filename=NEWS.txt, duration=1.0 sec 165.0 msecs 511.846542 usecs, local_orig=, is_orig=T, seen_bytes=10809, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=] -1254722771.858334 mime_entity_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_entity_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 0 [2] data: string = -1254722771.858334 mime_end_entity - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722771.858334 event_queue_flush_point -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722771.858334 event_queue_flush_point -1254722771.858334 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = ------=_NextPart_000_0004_01CA45B0.095693F0-- -1254722771.858334 smtp_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1254722771.858334 mime_all_data - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_all_data + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] length: count = 12754 [2] data: string = Hello\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aI send u smtp pcap file \x0d\x0a\x0d\x0aFind the attachment\x0d\x0a\x0d\x0a \x0d\x0a\x0d\x0aGPS\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a

Hello

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

I send u smtp pcap file

\x0d\x0a\x0d\x0a

Find the attachment

\x0d\x0a\x0d\x0a

 

\x0d\x0a\x0d\x0a

GPS

\x0d\x0a\x0d\x0a
\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0a\x0d\x0aVersion 4.9.9.1\x0d\x0a* Many bug fixes\x0d\x0a* Improved editor\x0d\x0a\x0d\x0aVersion 4.9.9.0\x0d\x0a* Support for latest Mingw compiler system builds\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.9\x0d\x0a* New code tooltip display\x0d\x0a* Improved Indent/Unindent and Remove Comment\x0d\x0a* Improved automatic indent\x0d\x0a* Added support for the "interface" keyword\x0d\x0a* WebUpdate should now report installation problems from PackMan\x0d\x0a* New splash screen and association icons\x0d\x0a* Improved installer\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.7\x0d\x0a* Added support for GCC > 3.2\x0d\x0a* Debug variables are now resent during next debug session\x0d\x0a* Watched Variables not in correct context are now kept and updated when it is needed\x0d\x0a* Added new compiler/linker options: \x0d\x0a - Strip executable\x0d\x0a - Generate instructions for a specific machine (i386, i486, i586, i686, pentium, pentium-mmx, pentiumpro, pentium2, pentium3, pentium4, \x0d\x0a k6, k6-2, k6-3, athlon, athlon-tbird, athlon-4, athlon-xp, athlon-mp, winchip-c6, winchip2, k8, c3 and c3-2)\x0d\x0a - Enable use of processor specific built-in functions (mmmx, sse, sse2, pni, 3dnow)\x0d\x0a* "Default" button in Compiler Options is back\x0d\x0a* Error messages parsing improved\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.5\x0d\x0a* Added the possibility to modify the value of a variable during debugging (right click on a watch variable and select "Modify value")\x0d\x0a* During Dev-C++ First Time COnfiguration window, users can now choose between using or not class browser and code completion features.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.4\x0d\x0a* Added the possibility to specify an include directory for the code completion cache to be created at Dev-C++ first startup\x0d\x0a* Improved code completion cache\x0d\x0a* WebUpdate will now backup downloaded DevPaks in Dev-C++\Packages directory, and Dev-C++ executable in devcpp.exe.BACKUP\x0d\x0a* Big speed up in function parameters listing while editing\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.3\x0d\x0a* On Dev-C++ first time configuration dialog, a code completion cache of all the standard \x0d\x0a include files can now be generated.\x0d\x0a* Improved WebUpdate module\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.8.2\x0d\x0a* New debug feature for DLLs: attach to a running process\x0d\x0a* New project option: Use custom Makefile. \x0d\x0a* New WebUpdater module.\x0d\x0a* Allow user to specify an alternate configuration file in Environment Options \x0d\x0a (still can be overriden by using "-c" command line parameter).\x0d\x0a* Lots of bug fixes.\x0d\x0a\x0d\x0aVersion 4.9.8.1\x0d\x0a* When creating a DLL, the created static lib respects now the project-defined output directory\x0d\x0a\x0d\x0aVersion 4.9.8.0\x0d\x0a* Changed position of compiler/linker parameters in Project Options.\x0d\x0a* Improved help file\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.9\x0d\x0a* Resource errors are now reported in the Resource sheet\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.8\x0d\x0a* Made whole bottom report control floating instead of only debug output.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.7\x0d\x0a* Printing settings are now saved\x0d\x0a* New environment options : "watch variable under mouse" and "Report watch errors"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.6\x0d\x0a* Debug variable browser\x0d\x0a* Added possibility to include in a Template the Project's directories (include, libs and ressources)\x0d\x0a* Changed tint of Class browser pictures colors to match the New Look style\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.5\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.4\x0d\x0a* When compiling with debugging symbols, an extra definition is passed to the\x0d\x0a compiler: -D__DEBUG__\x0d\x0a* Each project creates a _private.h file containing version\x0d\x0a information definitions\x0d\x0a* When compiling the current file only, no dependency checks are performed\x0d\x0a* ~300% Speed-up in class parser\x0d\x0a* Added "External programs" in Tools/Environment Options (for units "Open with")\x0d\x0a* Added "Open with" in project units context menu\x0d\x0a* Added "Classes" toolbar\x0d\x0a* Fixed pre-compilation dependency checks to work correctly\x0d\x0a* Added new file menu entry: Save Project As\x0d\x0a* Bug-fix for double quotes in devcpp.cfg file read by vUpdate\x0d\x0a* Other bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.3\x0d\x0a* When adding debugging symbols on request, remove "-s" option from linker\x0d\x0a* Compiling progress window\x0d\x0a* Environment options : "Show progress window" and "Auto-close progress window"\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.2\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.1\x0d\x0a* "Build priority" per-unit\x0d\x0a* "Include file in linking process" per-unit\x0d\x0a* New feature: compile current file only\x0d\x0a* Separated C++ compiler options from C compiler options in Makefile (see bug report #654744)\x0d\x0a* Separated C++ include dirs from C include dirs in Makefile (see bug report #654744)\x0d\x0a* Necessary UI changes in Project Options\x0d\x0a* Added display of project filename, project output and a summary of the project files in Project Options General tab.\x0d\x0a* Fixed the "compiler-dirs-with-spaces" bug that crept-in in 4.9.7.0\x0d\x0a* Multi-select files in project-view (when "double-click to open" is configured in Environment Settings)\x0d\x0a* Resource files are treated as ordinary files now\x0d\x0a* Updates in "Project Options/Files" code\x0d\x0a* MSVC import now creates the folders structure of the original VC project\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.7.0\x0d\x0a* Allow customizing of per-unit compile command in projects\x0d\x0a* Added two new macros: and \x0d\x0a* Added support for macros in the "default source code" (Tools/Editor Options/Code)\x0d\x0a* Separated layout info from project file. It is now kept in a different file\x0d\x0a (the same filename as the project's but with extension ".layout"). If you\x0d\x0a have your project under CVS control, you ''ll know why this had to happen...\x0d\x0a* Compiler settings per-project\x0d\x0a* Compiler set per-project\x0d\x0a* Implemented new compiler settings framework\x0d\x0a* "Compile as C++" per-unit\x0d\x0a* "Include file in compilation process" per-unit\x0d\x0a* Project version info (creates the relevant VERSIONINFO struct in the private\x0d\x0a resource)\x0d\x0a* Support XP Themes (creates the CommonControls 6.0 manifest file and includes\x0d\x0a it in the private resource)\x0d\x0a* Added CVS "login" and "logout" commands\x0d\x0a* Project manager and debugging window (in Debug tab) can now be trasnformed into floating windows.\x0d\x0a* Added "Add Library" button in Project Options\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.9\x0d\x0a* Implemented search in help files for the word at cursor (context sensitive help)\x0d\x0a* Implemented "compiler sets" infrastructure to switch between different compilers easily (e.g. gcc-2.95 and gcc-3.2)\x0d\x0a* Added "Files" tab in CVS form to allow selection of more than one file for\x0d\x0a the requested CVS action\x0d\x0a \x0d\x0aVersion 4.9.6.8\x0d\x0a* support for DLL application hosting, for debugging and executing DLLs under Dev-C++.\x0d\x0a* New class browser option: "Show inherited members"\x0d\x0a* Added support for the '::' member access operator in code-completion\x0d\x0a* Added *working* function arguments hint\x0d\x0a* Added bracket highlighting. When the caret is on a bracket, that bracket and\x0d\x0a its counterpart are highlighted\x0d\x0a* Nested folders in project view\x0d\x0a\x0d\x0aVersion 4.9.6.7\x0d\x0a* XP Theme support\x0d\x0a* Added CVS commands "Add" and "Remove"\x0d\x0a* Added configuration option for "Templates Directory" in "Environment Options"\x0d\x0a* Code-completion updates\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.6\x0d\x0a* Editor colors are initialized properly on Dev-C++ first-run\x0d\x0a* Added doxygen-style comments in NewClass, NewMemberFunction and NewMemberVariable wizards\x0d\x0a* Added file's date/time stamp in File/Properties window\x0d\x0a* Current windows listing in Window menu\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aVersion 4.9.6.5\x0d\x0a* CVS support\x0d\x0a* Window list (in Window menu)\x0d\x0a* bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.4\x0d\x0a* added ENTER key for opening file in project browser, DEL to delete from the project.\x0d\x0a* bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.3\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.2\x0d\x0a* Bug fixes\x0d\x0a\x0d\x0aversion 4.9.6.1\x0d\x0a* New "Abort compilation" button\x0d\x0a* Bug fixes\x0d\x0a* Now checks for vRoach existance when sending a crash report\x0d\x0a\x0d\x0aVersion 4.9.5.5\x0d\x0a* New option in Editor Options: Show editor hints. User can disable the hints\x0d\x0a displayed in the editor when the mouse moves over a word. Since this was the\x0d\x0a cause of many errors (although it should be fixed by now), we are giving the\x0d\x0a user the option to disable this feature.\x0d\x0a* New option in Editor Options (code-completion): Use code-completion cache.\x0d\x0a Well, it adds caching to code-completion. Depending on the cache size,\x0d\x0a the program may take a bit longer to start-up, but provides very fast\x0d\x0a code-completion and the user has all the commands (belonging to the files\x0d\x0a he added in the cache) at his fingertips. If, for example, the user adds\x0d\x0a "windows.h", he gets all the WinAPI! If he adds "wx/wx.h", he gets all of\x0d\x0a wxWindows! You get the picture...\x0d\x0a* Removed "Only show classes from current file" option in class browser settings.\x0d\x0a It used to be a checkbox, allowing only two states (on or off), but there is\x0d\x0a a third relevant option now: "Project classes" so it didn't fit the purpose...\x0d\x0a The user can define this in the class browser's context menu under "View mode".\x0d\x0a* Fixed the dreaded "Clock skew detected" compiler warning!\x0d\x0a* Fixed many class browser bugs, including some that had to do with class folders.\x0d\x0a\x0d\x0aVersion 4.9.5.4\x0d\x0a* Under NT, 2000 and XP, user application data directory will be used to store config files (i.e : C:\Documents and Settings\Username\Local Settings\Application Data)\x0d\x0a\x0d\x0aVersion 4.9.5.3\x0d\x0a* Added ExceptionsAnalyzer. If the devcpp.map file is in the devcpp.exe directory\x0d\x0a then we even get a stack trace in the bug report!\x0d\x0a* Added new WebUpdate module (inactive temporarily).\x0d\x0a* Added new code for code-completion caching of files (disabled - work in progress).\x0d\x0a\x0d\x0aVersion 4.9.5.2\x0d\x0a* Added new option in class-browser: Use colors\x0d\x0a (available when right-clicking the class-browser\x0d\x0a and selecting "View mode").\x0d\x0a* Dev-C++ now traps access violation of your programs (and of itself too ;)\x0d\x0a\x0d\x0aVersion 4.9.5.1\x0d\x0a* Implemented the "File/Export/Project to HTML" function.\x0d\x0a* Added "Tip of the day" system.\x0d\x0a* When running a source file in explorer, don't spawn new instance.\x0d\x0a Instead open the file in an already launched Dev-C++.\x0d\x0a* Class-parser speed-up (50% to 85% improvement timed!!!)\x0d\x0a* Many code-completion updates. Now takes into account context,\x0d\x0a class inheritance and visibility (shows items only from files\x0d\x0a #included directly or indirectly)!\x0d\x0a* Caching of result set of code-completion for speed-up.\x0d\x0a* New option "Execution/Parameters" (and "Debug/Parameters").\x0d\x0a\x0d\x0aVersion 4.9.5.0 (5.0 beta 5):\x0d\x0a* CPU Window (still in development)\x0d\x0a* ToDo list\x0d\x0a* Backtrace in debugging\x0d\x0a* Run to cursor\x0d\x0a* Folders in Project and Class Browser\x0d\x0a* Send custom commands to GDB\x0d\x0a* Makefile can now be customized.\x0d\x0a* Modified the behaviour of the -c param : \x0d\x0a -c \x0d\x0a* Saving of custom syntax parameter group\x0d\x0a* Possibility of changing compilers and tools filename.\x0d\x0a* Many bug fixes\x0d\x0a\x0d\x0a\x0d\x0aVersion 4.9.4.1 (5.0 beta 4.1):\x0d\x0a\x0d\x0a* back to gcc 2.95.3\x0d\x0a* Profiling support\x0d\x0a* new update/packages checker (vUpdate)\x0d\x0a* Lots of bugfixes\x0d\x0a\x0d\x0a -1254722771.858334 mime_content_hash - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_content_hash + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] content_len: count = 12754 [2] hash_value: string = \xb4\x1c\xd1smb\xff\xec\x9d\xf7\xd9Kz\x10\xd5M -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = T -1254722771.858334 event_queue_flush_point -1254722771.858334 get_file_handle +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [2] is_orig: bool = F -1254722771.858334 event_queue_flush_point -1254722771.858334 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = . [3] arg: string = . -1254722771.858334 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=83, cap_len=83, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=69, id=9565, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810367, ack=2934727550, hl=20, dl=29, reserved=0, flags=24, win=65073], udp=, icmp=] -1254722771.858334 event_queue_flush_point -1254722771.858334 event_queue_flush_point -1254722771.881223 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 352.0 msecs 176.904678 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 352.0 msecs 176.904678 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8688, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126804559, hl=20, dl=0, reserved=0, flags=16, win=23232], udp=, icmp=] -1254722771.881223 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 352.0 msecs 176.904678 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 352.0 msecs 176.904678 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -5950,17 +5947,17 @@ [5] len: count = 0 [6] payload: string = -1254722771.881223 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8688, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126804559, hl=20, dl=0, reserved=0, flags=16, win=23232], udp=, icmp=] -1254722771.881223 event_queue_flush_point -1254722771.881223 event_queue_flush_point -1254722771.905583 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=16, num_bytes_ip=1110, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 376.0 msecs 536.846161 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=16, num_bytes_ip=1110, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 376.0 msecs 536.846161 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8689, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126806011, hl=20, dl=0, reserved=0, flags=16, win=26136], udp=, icmp=] -1254722771.905583 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=16, num_bytes_ip=1110, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 376.0 msecs 536.846161 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=16, num_bytes_ip=1110, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 376.0 msecs 536.846161 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -5968,17 +5965,17 @@ [5] len: count = 0 [6] payload: string = -1254722771.905583 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8689, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126806011, hl=20, dl=0, reserved=0, flags=16, win=26136], udp=, icmp=] -1254722771.905583 event_queue_flush_point -1254722771.905583 event_queue_flush_point -1254722772.200179 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=17, num_bytes_ip=1150, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 671.0 msecs 133.041382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=17, num_bytes_ip=1150, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 671.0 msecs 133.041382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8690, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126807463, hl=20, dl=0, reserved=0, flags=16, win=29040], udp=, icmp=] -1254722772.200179 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=17, num_bytes_ip=1150, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 671.0 msecs 133.041382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=17, num_bytes_ip=1150, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 671.0 msecs 133.041382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -5986,17 +5983,17 @@ [5] len: count = 0 [6] payload: string = -1254722772.200179 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8690, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126807463, hl=20, dl=0, reserved=0, flags=16, win=29040], udp=, icmp=] -1254722772.200179 event_queue_flush_point -1254722772.200179 event_queue_flush_point -1254722772.222746 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=18, num_bytes_ip=1190, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 693.0 msecs 699.836731 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=18, num_bytes_ip=1190, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 693.0 msecs 699.836731 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8691, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126808915, hl=20, dl=0, reserved=0, flags=16, win=31944], udp=, icmp=] -1254722772.222746 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=18, num_bytes_ip=1190, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 693.0 msecs 699.836731 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=18, num_bytes_ip=1190, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 693.0 msecs 699.836731 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -6004,17 +6001,17 @@ [5] len: count = 0 [6] payload: string = -1254722772.222746 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8691, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126808915, hl=20, dl=0, reserved=0, flags=16, win=31944], udp=, icmp=] -1254722772.222746 event_queue_flush_point -1254722772.222746 event_queue_flush_point -1254722772.246844 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=19, num_bytes_ip=1230, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 717.0 msecs 797.994614 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=19, num_bytes_ip=1230, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 717.0 msecs 797.994614 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8692, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126810367, hl=20, dl=0, reserved=0, flags=16, win=34848], udp=, icmp=] -1254722772.246844 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=19, num_bytes_ip=1230, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 717.0 msecs 797.994614 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=19, num_bytes_ip=1230, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 717.0 msecs 797.994614 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -6022,17 +6019,17 @@ [5] len: count = 0 [6] payload: string = -1254722772.246844 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8692, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126810367, hl=20, dl=0, reserved=0, flags=16, win=34848], udp=, icmp=] -1254722772.246844 event_queue_flush_point -1254722772.246844 event_queue_flush_point -1254722772.248291 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=20, num_bytes_ip=1270, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 719.0 msecs 244.95697 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=20, num_bytes_ip=1270, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 719.0 msecs 244.95697 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8693, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126810396, hl=20, dl=0, reserved=0, flags=16, win=34848], udp=, icmp=] -1254722772.248291 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=20, num_bytes_ip=1270, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 719.0 msecs 244.95697 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=20, num_bytes_ip=1270, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 719.0 msecs 244.95697 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 463 @@ -6040,21 +6037,21 @@ [5] len: count = 0 [6] payload: string = -1254722772.248291 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8693, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126810396, hl=20, dl=0, reserved=0, flags=16, win=34848], udp=, icmp=] -1254722772.248291 event_queue_flush_point -1254722772.248291 event_queue_flush_point -1254722772.248789 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=68, id=8694, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126810396, hl=20, dl=28, reserved=0, flags=24, win=34848], udp=, icmp=] -1254722772.248789 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = 250 OK id=1Mugho-0003Dg-Un\x0d\x0a -1254722772.248789 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 463 @@ -6062,28 +6059,28 @@ [5] len: count = 28 [6] payload: string = 250 OK id=1Mugho-0003Dg-Un\x0d\x0a -1254722772.248789 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = . [4] msg: string = OK id=1Mugho-0003Dg-Un [5] cont_resp: bool = F -1254722772.248789 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=82, cap_len=82, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=68, id=8694, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727550, ack=2126810396, hl=20, dl=28, reserved=0, flags=24, win=34848], udp=, icmp=] -1254722772.248789 event_queue_flush_point -1254722772.248789 SMTP::log_smtp - [0] rec: SMTP::Info = [ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=250 OK id=1Mugho-0003Dg-Un, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX SMTP::log_smtp + [0] rec: SMTP::Info = [ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=250 OK id=1Mugho-0003Dg-Un, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]] -1254722772.248789 event_queue_flush_point -1254722772.387595 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 858.0 msecs 548.879623 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 858.0 msecs 548.879623 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=9568, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810396, ack=2934727578, hl=20, dl=0, reserved=0, flags=16, win=65045], udp=, icmp=] -1254722772.387595 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 858.0 msecs 548.879623 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 858.0 msecs 548.879623 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 14700 @@ -6091,22 +6088,22 @@ [5] len: count = 0 [6] payload: string = -1254722772.387595 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=9568, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810396, ack=2934727578, hl=20, dl=0, reserved=0, flags=16, win=65045], udp=, icmp=] -1254722772.387595 event_queue_flush_point -1254722772.387595 event_queue_flush_point -1254722774.763825 Broker::log_flush -1254722774.763825 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=46, id=9573, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810396, ack=2934727578, hl=20, dl=6, reserved=0, flags=24, win=65045], udp=, icmp=] -1254722774.763825 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = QUIT\x0d\x0a -1254722774.763825 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 14700 @@ -6114,23 +6111,23 @@ [5] len: count = 6 [6] payload: string = QUIT\x0d\x0a -1254722774.763825 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = QUIT [3] arg: string = -1254722774.763825 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=46, id=9573, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810396, ack=2934727578, hl=20, dl=6, reserved=0, flags=24, win=65045], udp=, icmp=] -1254722774.763825 event_queue_flush_point -1254722774.763825 event_queue_flush_point -1254722774.764576 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=26, num_bytes_ip=21593, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 235.0 msecs 529.899597 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=26, num_bytes_ip=21593, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 235.0 msecs 529.899597 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=9574, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810402, ack=2934727578, hl=20, dl=0, reserved=0, flags=17, win=65045], udp=, icmp=] -1254722774.764576 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=26, num_bytes_ip=21593, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 235.0 msecs 529.899597 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=26, num_bytes_ip=21593, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 235.0 msecs 529.899597 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = FA [3] seq: count = 14706 @@ -6138,26 +6135,26 @@ [5] len: count = 0 [6] payload: string = -1254722774.764576 connection_EOF - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=26, num_bytes_ip=21593, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 235.0 msecs 529.899597 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_EOF + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=26, num_bytes_ip=21593, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 235.0 msecs 529.899597 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T -1254722774.764576 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=9574, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810402, ack=2934727578, hl=20, dl=0, reserved=0, flags=17, win=65045], udp=, icmp=] -1254722774.764576 event_queue_flush_point -1254722774.764576 event_queue_flush_point -1254722775.105467 event_queue_flush_point -1254722775.105467 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=88, id=8695, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727578, ack=2126810402, hl=20, dl=48, reserved=0, flags=24, win=34848], udp=, icmp=] -1254722775.105467 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] contents: string = 221 xc90.websitewelcome.com closing connection\x0d\x0a -1254722775.105467 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 491 @@ -6165,28 +6162,28 @@ [5] len: count = 48 [6] payload: string = 221 xc90.websitewelcome.com closing connection\x0d\x0a -1254722775.105467 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 221 [3] cmd: string = QUIT [4] msg: string = xc90.websitewelcome.com closing connection [5] cont_resp: bool = F -1254722775.105467 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=102, cap_len=102, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=88, id=8695, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727578, ack=2126810402, hl=20, dl=48, reserved=0, flags=24, win=34848], udp=, icmp=] -1254722775.105467 event_queue_flush_point -1254722775.105467 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1254722775.105467 event_queue_flush_point -1254722775.105999 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=23, num_bytes_ip=1466, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=23, num_bytes_ip=1466, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8696, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727626, ack=2126810402, hl=20, dl=0, reserved=0, flags=17, win=34848], udp=, icmp=] -1254722775.105999 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=23, num_bytes_ip=1466, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=23, num_bytes_ip=1466, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = FA [3] seq: count = 539 @@ -6194,24 +6191,24 @@ [5] len: count = 0 [6] payload: string = -1254722775.105999 connection_EOF - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=23, num_bytes_ip=1466, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_EOF + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=23, num_bytes_ip=1466, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F -1254722775.105999 connection_finished - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=23, num_bytes_ip=1466, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_finished + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=23, num_bytes_ip=1466, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] -1254722775.105999 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8696, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727626, ack=2126810402, hl=20, dl=0, reserved=0, flags=17, win=34848], udp=, icmp=] -1254722775.105999 event_queue_flush_point -1254722775.105999 event_queue_flush_point -1254722775.106015 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=24, num_bytes_ip=1506, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=24, num_bytes_ip=1506, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=9577, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810403, ack=2934727627, hl=20, dl=0, reserved=0, flags=16, win=64997], udp=, icmp=] -1254722775.106015 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=24, num_bytes_ip=1506, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=24, num_bytes_ip=1506, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 14707 @@ -6219,17 +6216,17 @@ [5] len: count = 0 [6] payload: string = -1254722775.106015 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=00:e0:1c:3c:17:c2, dst=00:1f:33:d9:81:60, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=9577, ttl=128, p=6, src=10.10.1.4, dst=74.53.140.153], ip6=, tcp=[sport=1470/tcp, dport=25/tcp, seq=2126810403, ack=2934727627, hl=20, dl=0, reserved=0, flags=16, win=64997], udp=, icmp=] -1254722775.106015 event_queue_flush_point -1254722775.106015 event_queue_flush_point -1254722775.106759 new_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=24, num_bytes_ip=1506, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=24, num_bytes_ip=1506, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=96, len=40, id=8697, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727627, ack=2126810403, hl=20, dl=0, reserved=0, flags=16, win=34848], udp=, icmp=] -1254722775.106759 tcp_packet - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=24, num_bytes_ip=1506, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=24, num_bytes_ip=1506, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 540 @@ -6237,77 +6234,77 @@ [5] len: count = 0 [6] payload: string = -1254722775.106759 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=00:1f:33:d9:81:60, dst=00:e0:1c:3c:17:c2, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=96, len=40, id=8697, ttl=50, p=6, src=74.53.140.153, dst=10.10.1.4], ip6=, tcp=[sport=25/tcp, dport=1470/tcp, seq=2934727627, ack=2126810403, hl=20, dl=0, reserved=0, flags=16, win=34848], udp=, icmp=] -1254722775.106759 event_queue_flush_point -1254722775.106759 event_queue_flush_point -1254722776.690444 Broker::log_flush -1254722776.690444 new_connection - [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=1254722776.690444, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722776.690444 new_packet - [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=1254722776.690444, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=229, id=13949, ttl=128, p=17, src=10.10.1.20, dst=10.10.1.255], ip6=, tcp=, udp=[sport=138/udp, dport=138/udp, ulen=209], icmp=] -1254722776.690444 packet_contents - [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=1254722776.690444, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x11\x02\x80\xde\x0a\x0a\x01\x14\x00\x8a\x00\xbb\x00\x00 ENEJFECNDDEEDGDFDFEBEBDADJEEEECA\x00 FHEPFCELEHFCEPFFFACACACACACACABN\x00\xffSMB%\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00!\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe8\x03\x00\x00\x00\x00\x00\x00\x00\x00!\x00V\x00\x03\x00\x01\x00\x00\x00\x02\x002\x00\MAILSLOT\BROWSE\x00\x01\x00\x80\xfc\x0a\x00MIT-3D655AA09DD\x00\x05\x01\x03\x10\x03\x00\x0f\x01U\xaa\x00 -1254722776.690444 udp_request - [0] u: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=1254722776.690444, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX udp_request + [0] u: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1254722776.690444 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=243, cap_len=243, src=00:02:3f:ec:61:11, dst=ff:ff:ff:ff:ff:ff, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=229, id=13949, ttl=128, p=17, src=10.10.1.20, dst=10.10.1.255], ip6=, tcp=, udp=[sport=138/udp, dport=138/udp, ulen=209], icmp=] -1254722776.690444 event_queue_flush_point -1254722776.690444 event_queue_flush_point -1437831776.764391 connection_timeout - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=1, num_bytes_ip=128, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX connection_timeout + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=1, num_bytes_ip=128, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 udp_session_done - [0] u: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=1, num_bytes_ip=128, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX udp_session_done + [0] u: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=1, num_bytes_ip=128, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 connection_state_remove - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=1, num_bytes_ip=128, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.49206, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, DNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, DNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], orig=[size=34, state=1, num_pkts=1, num_bytes_ip=62, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=100, state=1, num_pkts=1, num_bytes_ip=128, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=34.0 msecs 24.953842 usecs, service={\x0aDNS\x0a}, history=Dd, uid=CHhAvVGS1DHFjwGM9, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09DNS::finalize_dns\x0a\x09{ \x0a\x09if (!DNS::c?$dns_state) \x0a\x09\x09return ;\x0a\x0a\x09if (DNS::c$dns_state?$pending_query) \x0a\x09\x09inline(DNS::LOG, to_any_coerceDNS::c$dns_state$pending_query){{ \x0a\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_queries) \x0a\x09\x09inline(DNS::c$dns_state$pending_queries){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09if (DNS::c$dns_state?$pending_replies) \x0a\x09\x09inline(DNS::c$dns_state$pending_replies){{ \x0a\x09\x09 DNS::trans_id, DNS::q;\x0a\x09\x09{ \x0a\x09\x09for ([DNS::trans_id] in DNS::msgs) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(DNS::q){{ \x0a\x09\x09\x09 DNS::infos, DNS::i;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09inline(DNS::q, DNS::infos){{ \x0a\x09\x09\x09 Queue::ignored_val;\x0a\x09\x09\x09{ \x0a\x09\x09\x09Queue::i = Queue::q$bottom;\x0a\x09\x09\x09Queue::j = 0;\x0a\x09\x09\x09for ([Queue::ignored_val] in Queue::q$vals) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Queue::q$top <= Queue::i) \x0a\x09\x09\x09\x09\x09break ;\x0a\x0a\x09\x09\x09\x09Queue::ret[Queue::j] = Queue::q$vals[Queue::i];\x0a\x09\x09\x09\x09++Queue::j;\x0a\x09\x09\x09\x09++Queue::i;\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09for ([DNS::i] in DNS::infos) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(DNS::LOG, to_any_coerceDNS::infos[DNS::i]){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09clear_table(DNS::msgs);\x0a\x09\x09}\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=[pending_query=, pending_queries=, pending_replies=], ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 ChecksumOffloading::check -1437831776.764391 Broker::log_flush -1437831776.764391 connection_timeout - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=25, num_bytes_ip=1546, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ChecksumOffloading::check +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX connection_timeout + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=25, num_bytes_ip=1546, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] -1437831776.764391 connection_state_remove - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=25, num_bytes_ip=1546, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=28, num_bytes_ip=21673, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=5, num_pkts=25, num_bytes_ip=1546, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 952.934265 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTFf, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=221 xc90.websitewelcome.com closing connection, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] -1437831776.764391 connection_timeout - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=2192, state=1, num_pkts=4, num_bytes_ip=2304, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=1.0 msec 518.964767 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_timeout + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=2192, state=1, num_pkts=4, num_bytes_ip=2304, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 msec 518.964767 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=2192, state=1, num_pkts=4, num_bytes_ip=2304, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=1254722770.695115, duration=1.0 msec 518.964767 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], orig=[size=2192, state=1, num_pkts=4, num_bytes_ip=2304, flow_label=0, l2_addr=00:1f:33:d9:81:60], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 msec 518.964767 usecs, service={\x0a\x0a}, history=, uid=C4J4Th3PJpwUYZZ6gc, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 connection_timeout - [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=1, num_bytes_ip=229, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=1254722776.690444, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_timeout + [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=1, num_bytes_ip=229, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 connection_state_remove - [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=1, num_bytes_ip=229, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=1254722776.690444, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], orig=[size=201, state=1, num_pkts=1, num_bytes_ip=229, flow_label=0, l2_addr=00:02:3f:ec:61:11], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=ff:ff:ff:ff:ff:ff], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CtPZjS20MLrsMUOJi2, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 filter_change_tracking -1437831776.764391 new_connection_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX new_connection_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831776.764391 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=93, id=11069, ttl=64, p=6, src=192.168.133.100, dst=66.196.121.26], ip6=, tcp=[sport=49285/tcp, dport=5050/tcp, seq=3102346460, ack=957174106, hl=32, dl=41, reserved=0, flags=24, win=4096], udp=, icmp=] -1437831776.764391 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = YMSG\x00\x10\x00\x00\x00\x15\x00\x8a\x00\x00\x00\x00\x00@7\xb70\xc0\x80albertzaharovits\xc0\x80 -1437831776.764391 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 1 @@ -6315,55 +6312,55 @@ [5] len: count = 41 [6] payload: string = YMSG\x00\x10\x00\x00\x00\x15\x00\x8a\x00\x00\x00\x00\x00@7\xb70\xc0\x80albertzaharovits\xc0\x80 -1437831776.764391 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831776.764391 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831776.764391 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831776.764391 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403023531, echo_timestamp=4275162075]] -1437831776.764391 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=107, cap_len=107, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=93, id=11069, ttl=64, p=6, src=192.168.133.100, dst=66.196.121.26], ip6=, tcp=[sport=49285/tcp, dport=5050/tcp, seq=3102346460, ack=957174106, hl=32, dl=41, reserved=0, flags=24, win=4096], udp=, icmp=] -1437831776.764391 event_queue_flush_point -1437831776.764391 Conn::log_conn - [0] rec: Conn::Info = [ts=1254722767.49206, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, service=dns, duration=34.0 msecs 24.953842 usecs, orig_bytes=34, resp_bytes=100, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=Dd, orig_pkts=1, orig_ip_bytes=62, resp_pkts=1, resp_ip_bytes=128, tunnel_parents=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=CHhAvVGS1DHFjwGM9, id=[orig_h=10.10.1.4, orig_p=56166/udp, resp_h=10.10.1.1, resp_p=53/udp], proto=udp, service=dns, duration=34.0 msecs 24.953842 usecs, orig_bytes=34, resp_bytes=100, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=Dd, orig_pkts=1, orig_ip_bytes=62, resp_pkts=1, resp_ip_bytes=128, tunnel_parents=] -1437831776.764391 Conn::log_conn - [0] rec: Conn::Info = [ts=1254722767.529046, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], proto=tcp, service=smtp, duration=7.0 secs 576.0 msecs 952.934265 usecs, orig_bytes=14705, resp_bytes=538, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShAdDaTFf, orig_pkts=28, orig_ip_bytes=21673, resp_pkts=25, resp_ip_bytes=1546, tunnel_parents=] +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], proto=tcp, service=smtp, duration=7.0 secs 576.0 msecs 952.934265 usecs, orig_bytes=14705, resp_bytes=538, conn_state=SF, local_orig=, local_resp=, missed_bytes=0, history=ShAdDaTFf, orig_pkts=28, orig_ip_bytes=21673, resp_pkts=25, resp_ip_bytes=1546, tunnel_parents=] -1437831776.764391 Conn::log_conn - [0] rec: Conn::Info = [ts=1254722770.695115, uid=C4J4Th3PJpwUYZZ6gc, id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], proto=icmp, service=, duration=1.0 msec 518.964767 usecs, orig_bytes=2192, resp_bytes=0, conn_state=OTH, local_orig=, local_resp=, missed_bytes=0, history=, orig_pkts=4, orig_ip_bytes=2304, resp_pkts=0, resp_ip_bytes=0, tunnel_parents=] +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=C4J4Th3PJpwUYZZ6gc, id=[orig_h=192.168.1.1, orig_p=3/icmp, resp_h=10.10.1.4, resp_p=4/icmp], proto=icmp, service=, duration=1.0 msec 518.964767 usecs, orig_bytes=2192, resp_bytes=0, conn_state=OTH, local_orig=, local_resp=, missed_bytes=0, history=, orig_pkts=4, orig_ip_bytes=2304, resp_pkts=0, resp_ip_bytes=0, tunnel_parents=] -1437831776.764391 Conn::log_conn - [0] rec: Conn::Info = [ts=1254722776.690444, uid=CtPZjS20MLrsMUOJi2, id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], proto=udp, service=, duration=, orig_bytes=, resp_bytes=, conn_state=S0, local_orig=, local_resp=, missed_bytes=0, history=D, orig_pkts=1, orig_ip_bytes=229, resp_pkts=0, resp_ip_bytes=0, tunnel_parents=] +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=CtPZjS20MLrsMUOJi2, id=[orig_h=10.10.1.20, orig_p=138/udp, resp_h=10.10.1.255, resp_p=138/udp], proto=udp, service=, duration=, orig_bytes=, resp_bytes=, conn_state=S0, local_orig=, local_resp=, missed_bytes=0, history=D, orig_pkts=1, orig_ip_bytes=229, resp_pkts=0, resp_ip_bytes=0, tunnel_parents=] -1437831776.764391 event_queue_flush_point -1437831777.107399 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=16082, ttl=52, p=6, src=66.196.121.26, dst=192.168.133.100], ip6=, tcp=[sport=5050/tcp, dport=49285/tcp, seq=957174106, ack=3102346501, hl=32, dl=0, reserved=0, flags=16, win=8280], udp=, icmp=] -1437831777.107399 partial_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX partial_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831777.107399 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 1 @@ -6371,51 +6368,51 @@ [5] len: count = 0 [6] payload: string = -1437831777.107399 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831777.107399 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831777.107399 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831777.107399 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=4275222705, echo_timestamp=403023531]] -1437831777.107399 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=16082, ttl=52, p=6, src=66.196.121.26, dst=192.168.133.100], ip6=, tcp=[sport=5050/tcp, dport=49285/tcp, seq=957174106, ack=3102346501, hl=32, dl=0, reserved=0, flags=16, win=8280], udp=, icmp=] -1437831777.107399 event_queue_flush_point -1437831777.107399 event_queue_flush_point -1437831787.856895 Broker::log_flush -1437831787.856895 new_connection_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831787.856895 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831787.856895 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=64, id=43466, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465340, ack=0, hl=44, dl=0, reserved=0, flags=2, win=65535], udp=, icmp=] -1437831787.856895 connection_SYN_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_SYN_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=64, size=64, win_size=65535, win_scale=5, MSS=1460, SACK_OK=T] -1437831787.856895 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = S [3] seq: count = 0 @@ -6423,77 +6420,77 @@ [5] len: count = 0 [6] payload: string = -1437831787.856895 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 2 [3] optlen: count = 4 -1437831787.856895 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.856895 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 3 [3] optlen: count = 3 -1437831787.856895 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.856895 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.856895 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.856895 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 4 [3] optlen: count = 2 -1437831787.856895 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 0 [3] optlen: count = 1 -1437831787.856895 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=2, length=4, data=, mss=1460, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=3, length=3, data=, mss=, window_scale=5, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034601, echo_timestamp=0], [kind=4, length=2, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=0, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=]] -1437831787.856895 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=78, cap_len=78, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=64, id=43466, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465340, ack=0, hl=44, dl=0, reserved=0, flags=2, win=65535], udp=, icmp=] -1437831787.856895 event_queue_flush_point -1437831787.856895 event_queue_flush_point -1437831787.861602 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=60, id=0, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788254, ack=3976465341, hl=40, dl=0, reserved=0, flags=18, win=28960], udp=, icmp=] -1437831787.861602 connection_SYN_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_SYN_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=64, size=60, win_size=28960, win_scale=7, MSS=1460, SACK_OK=T] -1437831787.861602 connection_established - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_established + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831787.861602 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = SA [3] seq: count = 0 @@ -6501,55 +6498,55 @@ [5] len: count = 0 [6] payload: string = -1437831787.861602 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 2 [3] optlen: count = 4 -1437831787.861602 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 4 [3] optlen: count = 2 -1437831787.861602 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.861602 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.861602 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 3 [3] optlen: count = 3 -1437831787.861602 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 707.098007 usecs, service={\x0a\x0a}, history=Sh, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=2, length=4, data=, mss=1460, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=4, length=2, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84163, echo_timestamp=403034601], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=3, length=3, data=, mss=, window_scale=7, sack=, send_timestamp=, echo_timestamp=]] -1437831787.861602 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=74, cap_len=74, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=60, id=0, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788254, ack=3976465341, hl=40, dl=0, reserved=0, flags=18, win=28960], udp=, icmp=] -1437831787.861602 event_queue_flush_point -1437831787.861602 event_queue_flush_point -1437831787.861724 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=35904, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465341, ack=2131788255, hl=32, dl=0, reserved=0, flags=16, win=4117], udp=, icmp=] -1437831787.861724 connection_first_ACK - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_first_ACK + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831787.861724 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1 @@ -6557,44 +6554,44 @@ [5] len: count = 0 [6] payload: string = -1437831787.861724 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.861724 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.861724 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.861724 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 msecs 828.929901 usecs, service={\x0a\x0a}, history=ShA, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034617, echo_timestamp=84163]] -1437831787.861724 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=35904, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465341, ack=2131788255, hl=32, dl=0, reserved=0, flags=16, win=4117], udp=, icmp=] -1437831787.861724 event_queue_flush_point -1437831787.861724 event_queue_flush_point -1437831787.867142 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=87, id=51483, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788255, ack=3976465341, hl=32, dl=35, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.867142 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = 220 uprise ESMTP SubEthaSMTP null\x0d\x0a -1437831787.867142 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 1 @@ -6602,49 +6599,49 @@ [5] len: count = 35 [6] payload: string = 220 uprise ESMTP SubEthaSMTP null\x0d\x0a -1437831787.867142 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.867142 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.867142 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.867142 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84165, echo_timestamp=403034617]] -1437831787.867142 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = uprise ESMTP SubEthaSMTP null [5] cont_resp: bool = F -1437831787.867142 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=101, cap_len=101, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=87, id=51483, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788255, ack=3976465341, hl=32, dl=35, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.867142 event_queue_flush_point -1437831787.867142 event_queue_flush_point -1437831787.867255 event_queue_flush_point -1437831787.867255 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=57836, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465341, ack=2131788290, hl=32, dl=0, reserved=0, flags=16, win=4116], udp=, icmp=] -1437831787.867255 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1 @@ -6652,47 +6649,47 @@ [5] len: count = 0 [6] payload: string = -1437831787.867255 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.867255 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.867255 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.867255 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 360.002518 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034622, echo_timestamp=84165]] -1437831787.867255 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=57836, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465341, ack=2131788290, hl=32, dl=0, reserved=0, flags=16, win=4116], udp=, icmp=] -1437831787.867255 event_queue_flush_point -1437831787.867255 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1437831787.867255 event_queue_flush_point -1437831787.883306 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=76, id=6370, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465341, ack=2131788290, hl=32, dl=24, reserved=0, flags=24, win=4116], udp=, icmp=] -1437831787.883306 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = EHLO [192.168.133.100]\x0d\x0a -1437831787.883306 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 1 @@ -6700,51 +6697,51 @@ [5] len: count = 24 [6] payload: string = EHLO [192.168.133.100]\x0d\x0a -1437831787.883306 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.883306 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.883306 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.883306 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034638, echo_timestamp=84165]] -1437831787.883306 protocol_confirmation - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX protocol_confirmation + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0a\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] atype: enum = Analyzer::ANALYZER_SMTP [2] aid: count = 21 -1437831787.883306 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = EHLO [3] arg: string = [192.168.133.100] -1437831787.883306 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=90, cap_len=90, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=76, id=6370, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465341, ack=2131788290, hl=32, dl=24, reserved=0, flags=24, win=4116], udp=, icmp=] -1437831787.883306 event_queue_flush_point -1437831787.883306 event_queue_flush_point -1437831787.884969 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=51484, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788290, ack=3976465365, hl=32, dl=0, reserved=0, flags=16, win=227], udp=, icmp=] -1437831787.884969 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 36 @@ -6752,44 +6749,44 @@ [5] len: count = 0 [6] payload: string = -1437831787.884969 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.884969 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.884969 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.884969 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=28.0 msecs 74.026108 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84170, echo_timestamp=403034638]] -1437831787.884969 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=51484, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788290, ack=3976465365, hl=32, dl=0, reserved=0, flags=16, win=227], udp=, icmp=] -1437831787.884969 event_queue_flush_point -1437831787.884969 event_queue_flush_point -1437831787.886281 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=102, id=51485, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788290, ack=3976465365, hl=32, dl=50, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.886281 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 250-uprise\x0d\x0a250-8BITMIME\x0d\x0a250-AUTH LOGIN\x0d\x0a250 Ok\x0d\x0a -1437831787.886281 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 36 @@ -6797,72 +6794,72 @@ [5] len: count = 50 [6] payload: string = 250-uprise\x0d\x0a250-8BITMIME\x0d\x0a250-AUTH LOGIN\x0d\x0a250 Ok\x0d\x0a -1437831787.886281 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.886281 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.886281 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.886281 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84170, echo_timestamp=403034638]] -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = uprise [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 uprise, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 uprise, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = 8BITMIME [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 8BITMIME, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 8BITMIME, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = AUTH LOGIN [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH LOGIN, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH LOGIN, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.886281 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=116, cap_len=116, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=102, id=51485, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788290, ack=3976465365, hl=32, dl=50, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.886281 event_queue_flush_point -1437831787.886281 event_queue_flush_point -1437831787.886369 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=18318, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465365, ack=2131788340, hl=32, dl=0, reserved=0, flags=16, win=4115], udp=, icmp=] -1437831787.886369 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 25 @@ -6870,44 +6867,44 @@ [5] len: count = 0 [6] payload: string = -1437831787.886369 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.886369 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.886369 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.886369 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 474.020004 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034640, echo_timestamp=84170]] -1437831787.886369 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=18318, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465365, ack=2131788340, hl=32, dl=0, reserved=0, flags=16, win=4115], udp=, icmp=] -1437831787.886369 event_queue_flush_point -1437831787.886369 event_queue_flush_point -1437831787.887031 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=84, id=219, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465365, ack=2131788340, hl=32, dl=32, reserved=0, flags=24, win=4115], udp=, icmp=] -1437831787.887031 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = MAIL FROM:\x0d\x0a -1437831787.887031 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 25 @@ -6915,50 +6912,50 @@ [5] len: count = 32 [6] payload: string = MAIL FROM:\x0d\x0a -1437831787.887031 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.887031 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.887031 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.887031 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034640, echo_timestamp=84170]] -1437831787.887031 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = MAIL [3] arg: string = FROM: -1437831787.887031 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=98, cap_len=98, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=84, id=219, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465365, ack=2131788340, hl=32, dl=32, reserved=0, flags=24, win=4115], udp=, icmp=] -1437831787.887031 event_queue_flush_point -1437831787.887031 event_queue_flush_point -1437831787.889785 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=60, id=51486, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788340, ack=3976465397, hl=32, dl=8, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.889785 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 250 Ok\x0d\x0a -1437831787.889785 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 86 @@ -6966,48 +6963,48 @@ [5] len: count = 8 [6] payload: string = 250 Ok\x0d\x0a -1437831787.889785 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.889785 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.889785 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.889785 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84171, echo_timestamp=403034640]] -1437831787.889785 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = MAIL [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.889785 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=74, cap_len=74, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=60, id=51486, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788340, ack=3976465397, hl=32, dl=8, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.889785 event_queue_flush_point -1437831787.889785 event_queue_flush_point -1437831787.889862 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=60334, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465397, ack=2131788348, hl=32, dl=0, reserved=0, flags=16, win=4114], udp=, icmp=] -1437831787.889862 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 57 @@ -7015,44 +7012,44 @@ [5] len: count = 0 [6] payload: string = -1437831787.889862 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.889862 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.889862 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.889862 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 967.090607 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034643, echo_timestamp=84171]] -1437831787.889862 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=60334, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465397, ack=2131788348, hl=32, dl=0, reserved=0, flags=16, win=4114], udp=, icmp=] -1437831787.889862 event_queue_flush_point -1437831787.889862 event_queue_flush_point -1437831787.890232 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=84, id=21859, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465397, ack=2131788348, hl=32, dl=32, reserved=0, flags=24, win=4114], udp=, icmp=] -1437831787.890232 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = RCPT TO:\x0d\x0a -1437831787.890232 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 57 @@ -7060,50 +7057,50 @@ [5] len: count = 32 [6] payload: string = RCPT TO:\x0d\x0a -1437831787.890232 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.890232 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.890232 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.890232 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034643, echo_timestamp=84171]] -1437831787.890232 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.890232 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=98, cap_len=98, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=84, id=21859, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465397, ack=2131788348, hl=32, dl=32, reserved=0, flags=24, win=4114], udp=, icmp=] -1437831787.890232 event_queue_flush_point -1437831787.890232 event_queue_flush_point -1437831787.892986 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=60, id=51487, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788348, ack=3976465429, hl=32, dl=8, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.892986 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 250 Ok\x0d\x0a -1437831787.892986 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 94 @@ -7111,48 +7108,48 @@ [5] len: count = 8 [6] payload: string = 250 Ok\x0d\x0a -1437831787.892986 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.892986 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.892986 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.892986 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84172, echo_timestamp=403034643]] -1437831787.892986 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.892986 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=74, cap_len=74, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=60, id=51487, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788348, ack=3976465429, hl=32, dl=8, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.892986 event_queue_flush_point -1437831787.892986 event_queue_flush_point -1437831787.893056 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=32869, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465429, ack=2131788356, hl=32, dl=0, reserved=0, flags=16, win=4114], udp=, icmp=] -1437831787.893056 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 89 @@ -7160,44 +7157,44 @@ [5] len: count = 0 [6] payload: string = -1437831787.893056 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.893056 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.893056 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.893056 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 160.945892 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034646, echo_timestamp=84172]] -1437831787.893056 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=32869, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465429, ack=2131788356, hl=32, dl=0, reserved=0, flags=16, win=4114], udp=, icmp=] -1437831787.893056 event_queue_flush_point -1437831787.893056 event_queue_flush_point -1437831787.893587 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=85, id=31729, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465429, ack=2131788356, hl=32, dl=33, reserved=0, flags=24, win=4114], udp=, icmp=] -1437831787.893587 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = RCPT TO:\x0d\x0a -1437831787.893587 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 89 @@ -7205,50 +7202,50 @@ [5] len: count = 33 [6] payload: string = RCPT TO:\x0d\x0a -1437831787.893587 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.893587 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.893587 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.893587 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034646, echo_timestamp=84172]] -1437831787.893587 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.893587 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=99, cap_len=99, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=85, id=31729, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465429, ack=2131788356, hl=32, dl=33, reserved=0, flags=24, win=4114], udp=, icmp=] -1437831787.893587 event_queue_flush_point -1437831787.893587 event_queue_flush_point -1437831787.897624 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=60, id=51488, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788356, ack=3976465462, hl=32, dl=8, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.897624 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 250 Ok\x0d\x0a -1437831787.897624 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 102 @@ -7256,48 +7253,48 @@ [5] len: count = 8 [6] payload: string = 250 Ok\x0d\x0a -1437831787.897624 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.897624 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.897624 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.897624 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84173, echo_timestamp=403034646]] -1437831787.897624 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.897624 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=74, cap_len=74, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=60, id=51488, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788356, ack=3976465462, hl=32, dl=8, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.897624 event_queue_flush_point -1437831787.897624 event_queue_flush_point -1437831787.897720 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=32087, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465462, ack=2131788364, hl=32, dl=0, reserved=0, flags=16, win=4114], udp=, icmp=] -1437831787.897720 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 122 @@ -7305,44 +7302,44 @@ [5] len: count = 0 [6] payload: string = -1437831787.897720 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.897720 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.897720 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.897720 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 825.128555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034650, echo_timestamp=84173]] -1437831787.897720 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=32087, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465462, ack=2131788364, hl=32, dl=0, reserved=0, flags=16, win=4114], udp=, icmp=] -1437831787.897720 event_queue_flush_point -1437831787.897720 event_queue_flush_point -1437831787.898413 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=87, id=49663, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465462, ack=2131788364, hl=32, dl=35, reserved=0, flags=24, win=4114], udp=, icmp=] -1437831787.898413 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = RCPT TO:\x0d\x0a -1437831787.898413 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 122 @@ -7350,50 +7347,50 @@ [5] len: count = 35 [6] payload: string = RCPT TO:\x0d\x0a -1437831787.898413 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.898413 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.898413 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.898413 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034650, echo_timestamp=84173]] -1437831787.898413 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.898413 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=101, cap_len=101, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=87, id=49663, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465462, ack=2131788364, hl=32, dl=35, reserved=0, flags=24, win=4114], udp=, icmp=] -1437831787.898413 event_queue_flush_point -1437831787.898413 event_queue_flush_point -1437831787.901069 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=60, id=51489, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788364, ack=3976465497, hl=32, dl=8, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.901069 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = 250 Ok\x0d\x0a -1437831787.901069 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 110 @@ -7401,48 +7398,48 @@ [5] len: count = 8 [6] payload: string = 250 Ok\x0d\x0a -1437831787.901069 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.901069 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.901069 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.901069 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84174, echo_timestamp=403034650]] -1437831787.901069 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.901069 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=74, cap_len=74, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=60, id=51489, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788364, ack=3976465497, hl=32, dl=8, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.901069 event_queue_flush_point -1437831787.901069 event_queue_flush_point -1437831787.901148 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=31709, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465497, ack=2131788372, hl=32, dl=0, reserved=0, flags=16, win=4114], udp=, icmp=] -1437831787.901148 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 157 @@ -7450,44 +7447,44 @@ [5] len: count = 0 [6] payload: string = -1437831787.901148 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.901148 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.901148 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.901148 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 253.110886 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034653, echo_timestamp=84174]] -1437831787.901148 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=31709, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465497, ack=2131788372, hl=32, dl=0, reserved=0, flags=16, win=4114], udp=, icmp=] -1437831787.901148 event_queue_flush_point -1437831787.901148 event_queue_flush_point -1437831787.901697 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=58, id=10610, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465497, ack=2131788372, hl=32, dl=6, reserved=0, flags=24, win=4114], udp=, icmp=] -1437831787.901697 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] contents: string = DATA\x0d\x0a -1437831787.901697 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 157 @@ -7495,53 +7492,53 @@ [5] len: count = 6 [6] payload: string = DATA\x0d\x0a -1437831787.901697 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.901697 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.901697 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.901697 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034653, echo_timestamp=84174]] -1437831787.901697 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = DATA [3] arg: string = -1437831787.901697 mime_begin_entity - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_begin_entity + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] -1437831787.901697 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=72, cap_len=72, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=58, id=10610, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465497, ack=2131788372, hl=32, dl=6, reserved=0, flags=24, win=4114], udp=, icmp=] -1437831787.901697 event_queue_flush_point -1437831787.901697 event_queue_flush_point -1437831787.904758 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=89, id=51490, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788372, ack=3976465503, hl=32, dl=37, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.904758 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] contents: string = 354 End data with .\x0d\x0a -1437831787.904758 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 118 @@ -7549,48 +7546,48 @@ [5] len: count = 37 [6] payload: string = 354 End data with .\x0d\x0a -1437831787.904758 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.904758 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.904758 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.904758 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84175, echo_timestamp=403034653]] -1437831787.904758 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 354 [3] cmd: string = DATA [4] msg: string = End data with . [5] cont_resp: bool = F -1437831787.904758 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=103, cap_len=103, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=89, id=51490, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788372, ack=3976465503, hl=32, dl=37, reserved=0, flags=24, win=227], udp=, icmp=] -1437831787.904758 event_queue_flush_point -1437831787.904758 event_queue_flush_point -1437831787.904938 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=14746, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465503, ack=2131788409, hl=32, dl=0, reserved=0, flags=16, win=4112], udp=, icmp=] -1437831787.904938 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 163 @@ -7598,44 +7595,44 @@ [5] len: count = 0 [6] payload: string = -1437831787.904938 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.904938 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.904938 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.904938 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 43.012619 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034656, echo_timestamp=84175]] -1437831787.904938 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=14746, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465503, ack=2131788409, hl=32, dl=0, reserved=0, flags=16, win=4112], udp=, icmp=] -1437831787.904938 event_queue_flush_point -1437831787.904938 event_queue_flush_point -1437831787.905375 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=859, id=49517, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465503, ack=2131788409, hl=32, dl=807, reserved=0, flags=24, win=4112], udp=, icmp=] -1437831787.905375 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] contents: string = Content-Type: text/plain; charset=us-ascii\x0d\x0aMime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\))\x0d\x0aSubject: Re: Bro SMTP CC Header\x0d\x0aFrom: Albert Zaharovits \x0d\x0aIn-Reply-To: <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>\x0d\x0aDate: Sat, 25 Jul 2015 16:43:07 +0300\x0d\x0aCc: felica4uu@hotmail.com,\x0d\x0a davis_mark1@outlook.com\x0d\x0aContent-Transfer-Encoding: 7bit\x0d\x0aMessage-Id: \x0d\x0aReferences: <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>\x0d\x0aTo: ericlim220@yahoo.com\x0d\x0aX-Mailer: Apple Mail (2.2102)\x0d\x0a\x0d\x0a\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a.\x0d\x0a -1437831787.905375 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 163 @@ -7643,341 +7640,341 @@ [5] len: count = 807 [6] payload: string = Content-Type: text/plain; charset=us-ascii\x0d\x0aMime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\))\x0d\x0aSubject: Re: Bro SMTP CC Header\x0d\x0aFrom: Albert Zaharovits \x0d\x0aIn-Reply-To: <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>\x0d\x0aDate: Sat, 25 Jul 2015 16:43:07 +0300\x0d\x0aCc: felica4uu@hotmail.com,\x0d\x0a davis_mark1@outlook.com\x0d\x0aContent-Transfer-Encoding: 7bit\x0d\x0aMessage-Id: \x0d\x0aReferences: <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>\x0d\x0aTo: ericlim220@yahoo.com\x0d\x0aX-Mailer: Apple Mail (2.2102)\x0d\x0a\x0d\x0a\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a.\x0d\x0a -1437831787.905375 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.905375 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.905375 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.905375 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034656, echo_timestamp=84175]] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Type: text/plain; charset=us-ascii -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain; charset=us-ascii] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2102\)) -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Mime-Version, name=MIME-VERSION, value=1.0 (Mac OS X Mail 8.2 \(2102\))] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Subject: Re: Bro SMTP CC Header -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Subject, name=SUBJECT, value=Re: Bro SMTP CC Header] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = From: Albert Zaharovits -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=From, name=FROM, value=Albert Zaharovits ] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = In-Reply-To: <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com> -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=In-Reply-To, name=IN-REPLY-TO, value=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Date: Sat, 25 Jul 2015 16:43:07 +0300 -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Date, name=DATE, value=Sat, 25 Jul 2015 16:43:07 +0300] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Cc: felica4uu@hotmail.com, -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = davis_mark1@outlook.com -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc=, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Cc, name=CC, value=felica4uu@hotmail.com, davis_mark1@outlook.com] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Content-Transfer-Encoding: 7bit -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=7bit] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = Message-Id: -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=Message-Id, name=MESSAGE-ID, value=] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = References: <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com> -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=References, name=REFERENCES, value= <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = To: ericlim220@yahoo.com -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to=, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=To, name=TO, value=ericlim220@yahoo.com] -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = X-Mailer: Apple Mail (2.2102) -1437831787.905375 mime_one_header - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_one_header + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] h: mime_header_rec = [original_name=X-Mailer, name=X-MAILER, value=Apple Mail (2.2102)] -1437831787.905375 mime_all_headers - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_all_headers + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] hlist: table[count] of mime_header_rec = {\x0a\x09[2] = [original_name=Mime-Version, name=MIME-VERSION, value=1.0 (Mac OS X Mail 8.2 \(2102\))],\x0a\x09[11] = [original_name=To, name=TO, value=ericlim220@yahoo.com],\x0a\x09[5] = [original_name=In-Reply-To, name=IN-REPLY-TO, value=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>],\x0a\x09[7] = [original_name=Cc, name=CC, value=felica4uu@hotmail.com, davis_mark1@outlook.com],\x0a\x09[6] = [original_name=Date, name=DATE, value=Sat, 25 Jul 2015 16:43:07 +0300],\x0a\x09[10] = [original_name=References, name=REFERENCES, value= <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>],\x0a\x09[4] = [original_name=From, name=FROM, value=Albert Zaharovits ],\x0a\x09[12] = [original_name=X-Mailer, name=X-MAILER, value=Apple Mail (2.2102)],\x0a\x09[8] = [original_name=Content-Transfer-Encoding, name=CONTENT-TRANSFER-ENCODING, value=7bit],\x0a\x09[3] = [original_name=Subject, name=SUBJECT, value=Re: Bro SMTP CC Header],\x0a\x09[9] = [original_name=Message-Id, name=MESSAGE-ID, value=],\x0a\x09[1] = [original_name=Content-Type, name=CONTENT-TYPE, value=text/plain; charset=us-ascii]\x0a} -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = T -1437831787.905375 event_queue_flush_point -1437831787.905375 file_new - [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=1437831787.905375, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1437831787.905375 event_queue_flush_point -1437831787.905375 file_over_new_connection - [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=1437831787.905375, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831787.905375, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SMTP, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = T -1437831787.905375 event_queue_flush_point -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 75 [2] data: string = > On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = > On 25 Jul 2015, at 16:38, Albert Zaharovits wrote: -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 4 [2] data: string = > \x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = > -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 4 [2] data: string = > \x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = > -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 76 [2] data: string = >> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = >> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote: -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 5 [2] data: string = >> \x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = >> -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 23 [2] data: string = >> Bro SMTP CC Header\x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = >> Bro SMTP CC Header -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 9 [2] data: string = >> TEST\x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = >> TEST -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 4 [2] data: string = > \x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = > -1437831787.905375 mime_segment_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_segment_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 2 [2] data: string = \x0d\x0a -1437831787.905375 smtp_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] data: string = -1437831787.905375 mime_entity_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_entity_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 204 [2] data: string = \x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a -1437831787.905375 mime_end_entity - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_end_entity + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = T -1437831787.905375 event_queue_flush_point -1437831787.905375 file_sniff - [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=1437831787.905375, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a, info=[ts=1437831787.905375, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=text/plain, mime_types=[[strength=-20, mime=text/plain]], inferred=T] -1437831787.905375 event_queue_flush_point -1437831787.905375 file_state_remove - [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=1437831787.905375, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a, info=[ts=1437831787.905375, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=Fc5KpS3kUYqDLwWSMf, parent_id=, source=SMTP, is_orig=T, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a\x09}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SMTP::finalize_smtp\x0a\x09\x09{ \x0a\x09\x09if (SMTP::c?$smtp) \x0a\x09\x09\x09inline(SMTP::c){{ \x0a\x09\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09;\x0a\x09\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09\x09}\x0a\x09\x09\x09\x09}};\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09}};\x0a\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a\x09}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a\x09}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a\x09}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=\x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a, info=[ts=XXXXXXXXXX.XXXXXX, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = F -1437831787.905375 event_queue_flush_point -1437831787.905375 Files::log_files - [0] rec: Files::Info = [ts=1437831787.905375, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Files::log_files + [0] rec: Files::Info = [ts=XXXXXXXXXX.XXXXXX, fuid=Fc5KpS3kUYqDLwWSMf, tx_hosts={\x0a\x09192.168.133.100\x0a}, rx_hosts={\x0a\x09192.168.133.102\x0a}, conn_uids={\x0aCmES5u32sYpV7JYN\x0a}, source=SMTP, depth=1, analyzers={\x0a\x0a}, mime_type=text/plain, filename=, duration=0 secs, local_orig=, is_orig=T, seen_bytes=204, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=] -1437831787.905375 mime_all_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_all_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] length: count = 204 [2] data: string = \x0d\x0a> On 25 Jul 2015, at 16:38, Albert Zaharovits wrote:\x0d\x0a> \x0d\x0a> \x0d\x0a>> On 25 Jul 2015, at 16:21, Albert Zaharovits wrote:\x0d\x0a>> \x0d\x0a>> Bro SMTP CC Header\x0d\x0a>> TEST\x0d\x0a> \x0d\x0a\x0d\x0a -1437831787.905375 mime_content_hash - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX mime_content_hash + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] content_len: count = 204 [2] hash_value: string = \xf6\xbf\x92\xb1\x03\xa9\xd0\x08\xe0p\xc5;\xdf\x9ad\x0c -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = T -1437831787.905375 event_queue_flush_point -1437831787.905375 get_file_handle +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX get_file_handle [0] tag: enum = Analyzer::ANALYZER_SMTP - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [2] is_orig: bool = F -1437831787.905375 event_queue_flush_point -1437831787.905375 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = . [3] arg: string = . -1437831787.905375 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=873, cap_len=873, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=859, id=49517, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976465503, ack=2131788409, hl=32, dl=807, reserved=0, flags=24, win=4112], udp=, icmp=] -1437831787.905375 event_queue_flush_point -1437831787.905375 event_queue_flush_point -1437831787.914113 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=60, id=51491, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788409, ack=3976466310, hl=32, dl=8, reserved=0, flags=24, win=239], udp=, icmp=] -1437831787.914113 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] contents: string = 250 Ok\x0d\x0a -1437831787.914113 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 155 @@ -7985,51 +7982,51 @@ [5] len: count = 8 [6] payload: string = 250 Ok\x0d\x0a -1437831787.914113 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.914113 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831787.914113 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831787.914113 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=84177, echo_timestamp=403034656]] -1437831787.914113 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = . [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.914113 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=74, cap_len=74, src=00:08:ca:cc:ad:4c, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=60, id=51491, ttl=64, p=6, src=192.168.133.102, dst=192.168.133.100], ip6=, tcp=[sport=25/tcp, dport=49648/tcp, seq=2131788409, ack=3976466310, hl=32, dl=8, reserved=0, flags=24, win=239], udp=, icmp=] -1437831787.914113 event_queue_flush_point -1437831787.914113 SMTP::log_smtp - [0] rec: SMTP::Info = [ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX SMTP::log_smtp + [0] rec: SMTP::Info = [ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]] -1437831787.914113 event_queue_flush_point -1437831787.914215 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=44186, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976466310, ack=2131788417, hl=32, dl=0, reserved=0, flags=16, win=4112], udp=, icmp=] -1437831787.914215 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 970 @@ -8037,51 +8034,51 @@ [5] len: count = 0 [6] payload: string = -1437831787.914215 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.914215 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831787.914215 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831787.914215 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403034665, echo_timestamp=84177]] -1437831787.914215 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=00:08:ca:cc:ad:4c, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=44186, ttl=64, p=6, src=192.168.133.100, dst=192.168.133.102], ip6=, tcp=[sport=49648/tcp, dport=25/tcp, seq=3976466310, ack=2131788417, hl=32, dl=0, reserved=0, flags=16, win=4112], udp=, icmp=] -1437831787.914215 event_queue_flush_point -1437831787.914215 event_queue_flush_point -1437831798.533593 Broker::log_flush -1437831798.533593 new_connection_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_connection_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831798.533593 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831798.533593 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=137, id=63879, ttl=48, p=6, src=74.125.71.189, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49336/tcp, seq=3980080258, ack=1584252430, hl=32, dl=85, reserved=0, flags=24, win=873], udp=, icmp=] -1437831798.533593 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x00P\xa9\xd8\xbf\x07\x10\xa7\xeb\x96\x99\x9b\xb9F\xf3\xfe\xb0\xb2\xf1\xd2\xba\xef]\x0f:5\x15\xc3\x115A"\x91\x01\x018\xe1\xa8\xf6\xdeb\xc1\xf29p2\xd7\xeci\xc7\xa1Z\xc0B\x99i\xf8[\x04\xc3\xd1\xeac\xe47\xdb\x1e\xaa\xc6vZ\xe9\xaay\x05\xef\xde\xcb\xcd\x9c#\x1e -1437831798.533593 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 1 @@ -8089,44 +8086,44 @@ [5] len: count = 85 [6] payload: string = \x17\x03\x03\x00P\xa9\xd8\xbf\x07\x10\xa7\xeb\x96\x99\x9b\xb9F\xf3\xfe\xb0\xb2\xf1\xd2\xba\xef]\x0f:5\x15\xc3\x115A"\x91\x01\x018\xe1\xa8\xf6\xdeb\xc1\xf29p2\xd7\xeci\xc7\xa1Z\xc0B\x99i\xf8[\x04\xc3\xd1\xeac\xe47\xdb\x1e\xaa\xc6vZ\xe9\xaay\x05\xef\xde\xcb\xcd\x9c#\x1e -1437831798.533593 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533593 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533593 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831798.533593 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=^d, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=539416720, echo_timestamp=403018179]] -1437831798.533593 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=151, cap_len=151, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=137, id=63879, ttl=48, p=6, src=74.125.71.189, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49336/tcp, seq=3980080258, ack=1584252430, hl=32, dl=85, reserved=0, flags=24, win=873], udp=, icmp=] -1437831798.533593 event_queue_flush_point -1437831798.533593 event_queue_flush_point -1437831798.533640 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=137, id=63901, ttl=48, p=6, src=74.125.71.189, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49336/tcp, seq=3980080258, ack=1584252430, hl=32, dl=85, reserved=0, flags=24, win=873], udp=, icmp=] -1437831798.533640 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x00P\xa9\xd8\xbf\x07\x10\xa7\xeb\x96\x99\x9b\xb9F\xf3\xfe\xb0\xb2\xf1\xd2\xba\xef]\x0f:5\x15\xc3\x115A"\x91\x01\x018\xe1\xa8\xf6\xdeb\xc1\xf29p2\xd7\xeci\xc7\xa1Z\xc0B\x99i\xf8[\x04\xc3\xd1\xeac\xe47\xdb\x1e\xaa\xc6vZ\xe9\xaay\x05\xef\xde\xcb\xcd\x9c#\x1e -1437831798.533640 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 1 @@ -8134,44 +8131,44 @@ [5] len: count = 85 [6] payload: string = \x17\x03\x03\x00P\xa9\xd8\xbf\x07\x10\xa7\xeb\x96\x99\x9b\xb9F\xf3\xfe\xb0\xb2\xf1\xd2\xba\xef]\x0f:5\x15\xc3\x115A"\x91\x01\x018\xe1\xa8\xf6\xdeb\xc1\xf29p2\xd7\xeci\xc7\xa1Z\xc0B\x99i\xf8[\x04\xc3\xd1\xeac\xe47\xdb\x1e\xaa\xc6vZ\xe9\xaay\x05\xef\xde\xcb\xcd\x9c#\x1e -1437831798.533640 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533640 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533640 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831798.533640 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=1, num_bytes_ip=137, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=46.96846 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=539417055, echo_timestamp=403018179]] -1437831798.533640 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=151, cap_len=151, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=137, id=63901, ttl=48, p=6, src=74.125.71.189, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49336/tcp, seq=3980080258, ack=1584252430, hl=32, dl=85, reserved=0, flags=24, win=873], udp=, icmp=] -1437831798.533640 event_queue_flush_point -1437831798.533640 event_queue_flush_point -1437831798.533746 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=137, id=64044, ttl=48, p=6, src=74.125.71.189, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49336/tcp, seq=3980080258, ack=1584252430, hl=32, dl=85, reserved=0, flags=24, win=873], udp=, icmp=] -1437831798.533746 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x00P\xa9\xd8\xbf\x07\x10\xa7\xeb\x96\x99\x9b\xb9F\xf3\xfe\xb0\xb2\xf1\xd2\xba\xef]\x0f:5\x15\xc3\x115A"\x91\x01\x018\xe1\xa8\xf6\xdeb\xc1\xf29p2\xd7\xeci\xc7\xa1Z\xc0B\x99i\xf8[\x04\xc3\xd1\xeac\xe47\xdb\x1e\xaa\xc6vZ\xe9\xaay\x05\xef\xde\xcb\xcd\x9c#\x1e -1437831798.533746 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 1 @@ -8179,43 +8176,43 @@ [5] len: count = 85 [6] payload: string = \x17\x03\x03\x00P\xa9\xd8\xbf\x07\x10\xa7\xeb\x96\x99\x9b\xb9F\xf3\xfe\xb0\xb2\xf1\xd2\xba\xef]\x0f:5\x15\xc3\x115A"\x91\x01\x018\xe1\xa8\xf6\xdeb\xc1\xf29p2\xd7\xeci\xc7\xa1Z\xc0B\x99i\xf8[\x04\xc3\xd1\xeac\xe47\xdb\x1e\xaa\xc6vZ\xe9\xaay\x05\xef\xde\xcb\xcd\x9c#\x1e -1437831798.533746 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533746 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533746 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831798.533746 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=2, num_bytes_ip=274, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=153.064728 usecs, service={\x0a\x0a}, history=^dt, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=539417390, echo_timestamp=403018179]] -1437831798.533746 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=151, cap_len=151, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=137, id=64044, ttl=48, p=6, src=74.125.71.189, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49336/tcp, seq=3980080258, ack=1584252430, hl=32, dl=85, reserved=0, flags=24, win=873], udp=, icmp=] -1437831798.533746 event_queue_flush_point -1437831798.533746 event_queue_flush_point -1437831798.533765 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=63304, ttl=64, p=6, src=192.168.133.100, dst=74.125.71.189], ip6=, tcp=[sport=49336/tcp, dport=443/tcp, seq=1584252430, ack=3980080343, hl=32, dl=0, reserved=0, flags=16, win=4093], udp=, icmp=] -1437831798.533765 partial_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX partial_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831798.533765 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1 @@ -8223,40 +8220,40 @@ [5] len: count = 0 [6] payload: string = -1437831798.533765 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533765 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533765 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831798.533765 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=172.138214 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403045274, echo_timestamp=539416720]] -1437831798.533765 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=63304, ttl=64, p=6, src=192.168.133.100, dst=74.125.71.189], ip6=, tcp=[sport=49336/tcp, dport=443/tcp, seq=1584252430, ack=3980080343, hl=32, dl=0, reserved=0, flags=16, win=4093], udp=, icmp=] -1437831798.533765 event_queue_flush_point -1437831798.533765 event_queue_flush_point -1437831798.533813 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=6886, ttl=64, p=6, src=192.168.133.100, dst=74.125.71.189], ip6=, tcp=[sport=49336/tcp, dport=443/tcp, seq=1584252430, ack=3980080343, hl=32, dl=0, reserved=0, flags=16, win=4093], udp=, icmp=] -1437831798.533813 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1 @@ -8264,41 +8261,41 @@ [5] len: count = 0 [6] payload: string = -1437831798.533813 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533813 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533813 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831798.533813 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=220.060349 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403045274, echo_timestamp=539417055]] -1437831798.533813 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=6886, ttl=64, p=6, src=192.168.133.100, dst=74.125.71.189], ip6=, tcp=[sport=49336/tcp, dport=443/tcp, seq=1584252430, ack=3980080343, hl=32, dl=0, reserved=0, flags=16, win=4093], udp=, icmp=] -1437831798.533813 event_queue_flush_point -1437831798.533813 event_queue_flush_point -1437831798.533814 event_queue_flush_point -1437831798.533814 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=3407, ttl=64, p=6, src=192.168.133.100, dst=74.125.71.189], ip6=, tcp=[sport=49336/tcp, dport=443/tcp, seq=1584252430, ack=3980080343, hl=32, dl=0, reserved=0, flags=16, win=4093], udp=, icmp=] -1437831798.533814 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1 @@ -8306,53 +8303,53 @@ [5] len: count = 0 [6] payload: string = -1437831798.533814 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533814 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831798.533814 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831798.533814 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403045274, echo_timestamp=539417390]] -1437831798.533814 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=3407, ttl=64, p=6, src=192.168.133.100, dst=74.125.71.189], ip6=, tcp=[sport=49336/tcp, dport=443/tcp, seq=1584252430, ack=3980080343, hl=32, dl=0, reserved=0, flags=16, win=4093], udp=, icmp=] -1437831798.533814 event_queue_flush_point -1437831798.533814 load_sample +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX load_sample [2] dmem: int = 0 -1437831798.533814 event_queue_flush_point -1437831799.262632 new_connection_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_connection_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.262632 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.262632 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=766, id=17405, ttl=64, p=6, src=192.168.133.100, dst=17.172.238.21], ip6=, tcp=[sport=49153/tcp, dport=5223/tcp, seq=1896121299, ack=4026911025, hl=32, dl=714, reserved=0, flags=24, win=4096], udp=, icmp=] -1437831799.262632 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x01\x00 >\x80e\xb5&*\xde\x1at\x92\xacY~\xd32\\xa1\xb2F\x95\x12,zaq\xe2\x99*\x9d N6\x17\x03\x01\x02\xa0C\xe1\xbd\x00\xfa\xc1\x15\xad0\xdf\x1f\xc9\xa14\xcf\xf1:7\xc1T(t\x9dx\x8f\xbd\xc7L\x87\xa2\xac\x80@Bc3\x1e\xcf\x7fd5PT\x8f\xd0\xc8 \xa9c\x13\xce\xcd\xaf!\x18>+\xf5\xd9\xb5;\xb9h\x1aRj\xd1\x88\xd2Q\xf4W\xfe#\xdc\x9e\xa9\x99\xaa\x9e@!J\xe4\x84o)\xe2T\x9cr\xa0mjpQ:\x09\xba3\xc0\xca\xd2\x06\xbfK\x0a\xb4\xea\x9d\x93,\x9a\x19\xd2]A\xa7\x81.\xa2\xad\xdfA\x07\xbd@\x98t\x19\xd0\xe6\x05\x10\xceI\x89\xe9\x89p=\xe9F93D\xb8\x9d\xb7\xf7\x87\xb1\xe2\xb6\x08\xf7\x14\xa0*L\xb7W\x82\xdar.P\x04'g\\xa2\xdb\x9b\x12\xa8\x8d27~3J%\xff\x8d\xe7\xcbx2\xc6\xa003 N\xe3\xcc:\x91#+\x94\x08\xbe_O\xd6\xb5\xe7\xb1\x154o'aW=E\xf3\x81\xef\xd6[\xc5AD\xff\x9a\x02\xfb%\x83k7o\xaf2\x12\x10\xe5\x9fFKeZp\xa5\xeehfh\x05\x19S\x0cl\x98\xbd\xa5:\xb5G\xd2X\xdd\xccU\x18\x85\xf2\xaf\xc9\xcf\xab\x02c\x7f\x14\x82,\xe94\xc8k\x15MV\xfan\xfb\xf5\x0b\xaf\x10Myd\xb7xT\xa6\x8cz>\xe7\x12\x10\xee"\x0eu\x8a\xec\x93oYrf\xab\xea\xa7\x86\x12.\xfc\x92\x849'c\xe9\xf5K\xef:\x88,u\xaam6\xdcGh\xd6F\xab\xfe\xf7`=\xb6S\xe7-"\xa3\xa5}\x86\x85\x93\xe8m\x8e\x14\xa7^\x11\xcb\x8f\xa7\xa1]n\x1a\x08\xce\xc4wf\xb7e\xed\x91$\x04b\x12\xc5\xfb\x13C\xa9\x9381\xac\xd1\x96k\xf9\xe3I*\x862\x90:a\xc6\xe2kxP\xf5\xd0\xa0\xb9\x99\x96-\x0aw\xb7\x18`\x17\xde\xd0dW\x95a`~\xb6R\xf1z2\xd9\x1f\x8ah\xb9\xfa\xb3\xd6\x83\x01gdw_\xdd\x80^K\xcb\xb6{\xa0\x06\xedo\xb2\xeb\x1c\x89\x0c\x16~\xbe\x10\xaa\x8b\xcf\x87\xab\xfbv"\xe2\xcc\xcb\xc9\x0aB\x04\xa4\xdc\xe5%\xfe\xcf\x8e\xcd\x86\x93\xbd\xac\xe5]\x9dJ\x82+\xec\x94.\xb9\xf4\x84\xa0\xe3\x95o\xe7R\xadAFd\xfe\xfd\x0b\xa5\x0f\xe3d\xeb3-\xc7R\xff\xb4j^\xbe\xbe\xb3faY|?\x02\xae\x97M\xdel(\x91\xa8r\xd2h\xda\xe9\x8e\xb3\xd0\xa8\x7f)m5F"\xb9\xd9\xeb&6\xcbrr\x9d\x8a\x15\xf4\xe5t\xf3\x83\x83\xa5+R\xd8\xafJ\x15\x12\x8d\x13#\xb0\x897@Z\xd5\x05\xc3\x95\x93\x8e\xaa:\xc4\xaf\xf5\x13\xf2V\x11\xe9w\x193\x81d\x1a\x05\xa8\x92\x97\x8f\xcd:E\x7f2\xc9v\x7f\x854_+\xd36\xb9\xfb\x9d\x95\x84)\xdekD\x9f\x01h\x9a\xdf \xfbH\xfcH\xafN\x0c\xe0\xf0\x9b\xe4 -1437831799.262632 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 1 @@ -8360,43 +8357,43 @@ [5] len: count = 714 [6] payload: string = \x17\x03\x01\x00 >\x80e\xb5&*\xde\x1at\x92\xacY~\xd32\\xa1\xb2F\x95\x12,zaq\xe2\x99*\x9d N6\x17\x03\x01\x02\xa0C\xe1\xbd\x00\xfa\xc1\x15\xad0\xdf\x1f\xc9\xa14\xcf\xf1:7\xc1T(t\x9dx\x8f\xbd\xc7L\x87\xa2\xac\x80@Bc3\x1e\xcf\x7fd5PT\x8f\xd0\xc8 \xa9c\x13\xce\xcd\xaf!\x18>+\xf5\xd9\xb5;\xb9h\x1aRj\xd1\x88\xd2Q\xf4W\xfe#\xdc\x9e\xa9\x99\xaa\x9e@!J\xe4\x84o)\xe2T\x9cr\xa0mjpQ:\x09\xba3\xc0\xca\xd2\x06\xbfK\x0a\xb4\xea\x9d\x93,\x9a\x19\xd2]A\xa7\x81.\xa2\xad\xdfA\x07\xbd@\x98t\x19\xd0\xe6\x05\x10\xceI\x89\xe9\x89p=\xe9F93D\xb8\x9d\xb7\xf7\x87\xb1\xe2\xb6\x08\xf7\x14\xa0*L\xb7W\x82\xdar.P\x04'g\\xa2\xdb\x9b\x12\xa8\x8d27~3J%\xff\x8d\xe7\xcbx2\xc6\xa003 N\xe3\xcc:\x91#+\x94\x08\xbe_O\xd6\xb5\xe7\xb1\x154o'aW=E\xf3\x81\xef\xd6[\xc5AD\xff\x9a\x02\xfb%\x83k7o\xaf2\x12\x10\xe5\x9fFKeZp\xa5\xeehfh\x05\x19S\x0cl\x98\xbd\xa5:\xb5G\xd2X\xdd\xccU\x18\x85\xf2\xaf\xc9\xcf\xab\x02c\x7f\x14\x82,\xe94\xc8k\x15MV\xfan\xfb\xf5\x0b\xaf\x10Myd\xb7xT\xa6\x8cz>\xe7\x12\x10\xee"\x0eu\x8a\xec\x93oYrf\xab\xea\xa7\x86\x12.\xfc\x92\x849'c\xe9\xf5K\xef:\x88,u\xaam6\xdcGh\xd6F\xab\xfe\xf7`=\xb6S\xe7-"\xa3\xa5}\x86\x85\x93\xe8m\x8e\x14\xa7^\x11\xcb\x8f\xa7\xa1]n\x1a\x08\xce\xc4wf\xb7e\xed\x91$\x04b\x12\xc5\xfb\x13C\xa9\x9381\xac\xd1\x96k\xf9\xe3I*\x862\x90:a\xc6\xe2kxP\xf5\xd0\xa0\xb9\x99\x96-\x0aw\xb7\x18`\x17\xde\xd0dW\x95a`~\xb6R\xf1z2\xd9\x1f\x8ah\xb9\xfa\xb3\xd6\x83\x01gdw_\xdd\x80^K\xcb\xb6{\xa0\x06\xedo\xb2\xeb\x1c\x89\x0c\x16~\xbe\x10\xaa\x8b\xcf\x87\xab\xfbv"\xe2\xcc\xcb\xc9\x0aB\x04\xa4\xdc\xe5%\xfe\xcf\x8e\xcd\x86\x93\xbd\xac\xe5]\x9dJ\x82+\xec\x94.\xb9\xf4\x84\xa0\xe3\x95o\xe7R\xadAFd\xfe\xfd\x0b\xa5\x0f\xe3d\xeb3-\xc7R\xff\xb4j^\xbe\xbe\xb3faY|?\x02\xae\x97M\xdel(\x91\xa8r\xd2h\xda\xe9\x8e\xb3\xd0\xa8\x7f)m5F"\xb9\xd9\xeb&6\xcbrr\x9d\x8a\x15\xf4\xe5t\xf3\x83\x83\xa5+R\xd8\xafJ\x15\x12\x8d\x13#\xb0\x897@Z\xd5\x05\xc3\x95\x93\x8e\xaa:\xc4\xaf\xf5\x13\xf2V\x11\xe9w\x193\x81d\x1a\x05\xa8\x92\x97\x8f\xcd:E\x7f2\xc9v\x7f\x854_+\xd36\xb9\xfb\x9d\x95\x84)\xdekD\x9f\x01h\x9a\xdf \xfbH\xfcH\xafN\x0c\xe0\xf0\x9b\xe4 -1437831799.262632 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831799.262632 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831799.262632 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831799.262632 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=D, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403046002, echo_timestamp=4183838604]] -1437831799.262632 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=780, cap_len=780, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=766, id=17405, ttl=64, p=6, src=192.168.133.100, dst=17.172.238.21], ip6=, tcp=[sport=49153/tcp, dport=5223/tcp, seq=1896121299, ack=4026911025, hl=32, dl=714, reserved=0, flags=24, win=4096], udp=, icmp=] -1437831799.262632 event_queue_flush_point -1437831799.262632 event_queue_flush_point -1437831799.410135 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=38117, ttl=52, p=6, src=17.172.238.21, dst=192.168.133.100], ip6=, tcp=[sport=5223/tcp, dport=49153/tcp, seq=4026911025, ack=1896122013, hl=32, dl=0, reserved=0, flags=16, win=375], udp=, icmp=] -1437831799.410135 partial_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX partial_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.410135 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 1 @@ -8404,50 +8401,50 @@ [5] len: count = 0 [6] payload: string = -1437831799.410135 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831799.410135 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831799.410135 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 8 [3] optlen: count = 10 -1437831799.410135 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=4183989261, echo_timestamp=403046002]] -1437831799.410135 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=38117, ttl=52, p=6, src=17.172.238.21, dst=192.168.133.100], ip6=, tcp=[sport=5223/tcp, dport=49153/tcp, seq=4026911025, ack=1896122013, hl=32, dl=0, reserved=0, flags=16, win=375], udp=, icmp=] -1437831799.410135 event_queue_flush_point -1437831799.410135 event_queue_flush_point -1437831799.461152 new_connection_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_connection_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.461152 new_connection - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_connection + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.461152 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=64, id=60923, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393379, ack=0, hl=44, dl=0, reserved=0, flags=2, win=65535], udp=, icmp=] -1437831799.461152 connection_SYN_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_SYN_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] pkt: SYN_packet = [is_orig=T, DF=T, ttl=64, size=64, win_size=65535, win_scale=5, MSS=1460, SACK_OK=T] -1437831799.461152 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = S [3] seq: count = 0 @@ -8455,78 +8452,78 @@ [5] len: count = 0 [6] payload: string = -1437831799.461152 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 2 [3] optlen: count = 4 -1437831799.461152 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831799.461152 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 3 [3] optlen: count = 3 -1437831799.461152 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831799.461152 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 1 [3] optlen: count = 1 -1437831799.461152 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 8 [3] optlen: count = 10 -1437831799.461152 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 4 [3] optlen: count = 2 -1437831799.461152 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] opt: count = 0 [3] optlen: count = 1 -1437831799.461152 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=1, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=0, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=0 secs, service={\x0a\x0a}, history=S, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] options: vector of TCP::Option = [[kind=2, length=4, data=, mss=1460, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=3, length=3, data=, mss=, window_scale=5, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=8, length=10, data=, mss=, window_scale=, sack=, send_timestamp=403046199, echo_timestamp=0], [kind=4, length=2, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=0, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=]] -1437831799.461152 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=78, cap_len=78, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=64, id=60923, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393379, ack=0, hl=44, dl=0, reserved=0, flags=2, win=65535], udp=, icmp=] -1437831799.461152 event_queue_flush_point -1437831799.461152 event_queue_flush_point -1437831799.610433 Broker::log_flush -1437831799.610433 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=52, id=50798, ttl=242, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319610143, ack=3289393380, hl=32, dl=0, reserved=0, flags=18, win=8190], udp=, icmp=] -1437831799.610433 connection_SYN_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_SYN_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] pkt: SYN_packet = [is_orig=F, DF=T, ttl=242, size=52, win_size=8190, win_scale=4, MSS=1440, SACK_OK=T] -1437831799.610433 connection_established - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_established + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.610433 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = SA [3] seq: count = 0 @@ -8534,62 +8531,62 @@ [5] len: count = 0 [6] payload: string = -1437831799.610433 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 2 [3] optlen: count = 4 -1437831799.610433 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831799.610433 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 3 [3] optlen: count = 3 -1437831799.610433 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831799.610433 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 1 [3] optlen: count = 1 -1437831799.610433 tcp_option - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_option + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] opt: count = 4 [3] optlen: count = 2 -1437831799.610433 tcp_options - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_options + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=0, num_bytes_ip=0, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 281.024933 usecs, service={\x0a\x0a}, history=Sh, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] options: vector of TCP::Option = [[kind=2, length=4, data=, mss=1440, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=3, length=3, data=, mss=, window_scale=4, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=1, length=1, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=], [kind=4, length=2, data=, mss=, window_scale=, sack=, send_timestamp=, echo_timestamp=]] -1437831799.610433 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=66, cap_len=66, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=52, id=50798, ttl=242, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319610143, ack=3289393380, hl=32, dl=0, reserved=0, flags=18, win=8190], udp=, icmp=] -1437831799.610433 event_queue_flush_point -1437831799.610433 event_queue_flush_point -1437831799.610433 event_queue_flush_point -1437831799.610567 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 415.016174 usecs, service={\x0a\x0a}, history=ShA, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 415.016174 usecs, service={\x0a\x0a}, history=ShA, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=56718, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393380, ack=2319610144, hl=20, dl=0, reserved=0, flags=16, win=8192], udp=, icmp=] -1437831799.610567 connection_first_ACK - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 415.016174 usecs, service={\x0a\x0a}, history=ShA, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_first_ACK + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 415.016174 usecs, service={\x0a\x0a}, history=ShA, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831799.610567 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=149.0 msecs 415.016174 usecs, service={\x0a\x0a}, history=ShA, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=0, state=4, num_pkts=1, num_bytes_ip=64, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=149.0 msecs 415.016174 usecs, service={\x0a\x0a}, history=ShA, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 1 @@ -8597,21 +8594,21 @@ [5] len: count = 0 [6] payload: string = -1437831799.610567 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=56718, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393380, ack=2319610144, hl=20, dl=0, reserved=0, flags=16, win=8192], udp=, icmp=] -1437831799.610567 event_queue_flush_point -1437831799.610567 event_queue_flush_point -1437831799.611764 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=241, id=39444, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393380, ack=2319610144, hl=20, dl=201, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831799.611764 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x16\x03\x01\x00\xc4\x01\x00\x00\xc0\x03\x03U\xb3\x92w\xd4\xda\xbe{\xfa\xaa\x16\xb2\xe7\x92\x9d\xbf\xe1c\x97\xde\xdca7\x92\x90\xf6\x967\xf7\xec\x1e\xe6\x00\x00J\x00\xff\xc0$\xc0#\xc0\x0a\xc0\x09\xc0\x08\xc0(\xc0'\xc0\x14\xc0\x13\xc0\x12\xc0&\xc0%\xc0\x05\xc0\x04\xc0\x03\xc0*\xc0)\xc0\x0f\xc0\x0e\xc0\x0d\x00k\x00g\x009\x003\x00\x16\x00=\x00<\x005\x00/\x00\x0a\xc0\x07\xc0\x11\xc0\x02\xc0\x0c\x00\x05\x00\x04\x01\x00\x00M\x00\x00\x00#\x00!\x00\x00\x1ep31-keyvalueservice.icloud.com\x00\x0a\x00\x08\x00\x06\x00\x17\x00\x18\x00\x19\x00\x0b\x00\x02\x01\x00\x00\x0d\x00\x0c\x00\x0a\x05\x01\x04\x01\x02\x01\x04\x03\x02\x033t\x00\x00 -1437831799.611764 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 1 @@ -8619,99 +8616,99 @@ [5] len: count = 201 [6] payload: string = \x16\x03\x01\x00\xc4\x01\x00\x00\xc0\x03\x03U\xb3\x92w\xd4\xda\xbe{\xfa\xaa\x16\xb2\xe7\x92\x9d\xbf\xe1c\x97\xde\xdca7\x92\x90\xf6\x967\xf7\xec\x1e\xe6\x00\x00J\x00\xff\xc0$\xc0#\xc0\x0a\xc0\x09\xc0\x08\xc0(\xc0'\xc0\x14\xc0\x13\xc0\x12\xc0&\xc0%\xc0\x05\xc0\x04\xc0\x03\xc0*\xc0)\xc0\x0f\xc0\x0e\xc0\x0d\x00k\x00g\x009\x003\x00\x16\x00=\x00<\x005\x00/\x00\x0a\xc0\x07\xc0\x11\xc0\x02\xc0\x0c\x00\x05\x00\x04\x01\x00\x00M\x00\x00\x00#\x00!\x00\x00\x1ep31-keyvalueservice.icloud.com\x00\x0a\x00\x08\x00\x06\x00\x17\x00\x18\x00\x19\x00\x0b\x00\x02\x01\x00\x00\x0d\x00\x0c\x00\x0a\x05\x01\x04\x01\x02\x01\x04\x03\x02\x033t\x00\x00 -1437831799.611764 ssl_extension_server_name - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension_server_name + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] names: vector of string = [p31-keyvalueservice.icloud.com] -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 0 [3] val: string = \x00!\x00\x00\x1ep31-keyvalueservice.icloud.com -1437831799.611764 ssl_extension_elliptic_curves - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension_elliptic_curves + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] curves: vector of count = [23, 24, 25] -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 10 [3] val: string = \x00\x06\x00\x17\x00\x18\x00\x19 -1437831799.611764 ssl_extension_ec_point_formats - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension_ec_point_formats + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] point_formats: vector of count = [0] -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 11 [3] val: string = \x01\x00 -1437831799.611764 ssl_extension_signature_algorithm - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension_signature_algorithm + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] signature_algorithms: vector of SSL::SignatureAndHashAlgorithm = [[HashAlgorithm=5, SignatureAlgorithm=1], [HashAlgorithm=4, SignatureAlgorithm=1], [HashAlgorithm=2, SignatureAlgorithm=1], [HashAlgorithm=4, SignatureAlgorithm=3], [HashAlgorithm=2, SignatureAlgorithm=3]] -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 13 [3] val: string = \x00\x0a\x05\x01\x04\x01\x02\x01\x04\x03\x02\x03 -1437831799.611764 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] code: count = 13172 [3] val: string = -1437831799.611764 protocol_confirmation - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX protocol_confirmation + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0a\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] atype: enum = Analyzer::ANALYZER_SSL [2] aid: count = 35 -1437831799.611764 ssl_client_hello - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_client_hello + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] version: count = 771 [2] record_version: count = 769 - [3] possible_ts: time = 1437831799.0 + [3] possible_ts: time = XXXXXXXXXX.XXXXXX [4] client_random: string = \xd4\xda\xbe{\xfa\xaa\x16\xb2\xe7\x92\x9d\xbf\xe1c\x97\xde\xdca7\x92\x90\xf6\x967\xf7\xec\x1e\xe6 [5] session_id: string = \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 [6] ciphers: vector of count = [255, 49188, 49187, 49162, 49161, 49160, 49192, 49191, 49172, 49171, 49170, 49190, 49189, 49157, 49156, 49155, 49194, 49193, 49167, 49166, 49165, 107, 103, 57, 51, 22, 61, 60, 53, 47, 10, 49159, 49169, 49154, 49164, 5, 4] [7] comp_methods: vector of count = [0] -1437831799.611764 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] msg_type: count = 1 [3] length: count = 192 -1437831799.611764 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=2, num_bytes_ip=104, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=150.0 msecs 611.877441 usecs, service={\x0aSSL\x0a}, history=ShAD, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] record_version: count = 769 [3] content_type: count = 22 [4] length: count = 196 -1437831799.611764 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=255, cap_len=255, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=241, id=39444, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393380, ack=2319610144, hl=20, dl=201, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831799.611764 event_queue_flush_point -1437831799.611764 event_queue_flush_point -1437831799.762680 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=301.0 msecs 527.97699 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=301.0 msecs 527.97699 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1480, id=50800, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319610144, ack=3289393581, hl=20, dl=1440, reserved=0, flags=24, win=2565], udp=, icmp=] -1437831799.762680 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=301.0 msecs 527.97699 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=301.0 msecs 527.97699 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x16\x03\x03\x0a$\x02\x00\x00M\x03\x03U\xb3\x92w\xe2RB\xdds\x11\xa9\xd4\x1d\xbc\x8e\xe2]\x09\xc5\xfc\xb1\xedl\xed\x17\xb2?a\xac\x81QM \x17x\xe5j\x19T\x12vWY\xcf\xf3\xeai\\xdf\x09[]\xb7\xdf.[\x0e\x04\xa8\x89bJ\x94\xa7\x0c\x00\x04\x00\x00\x05\xff\x01\x00\x01\x00\x0b\x00\x09\xcb\x00\x09\xc8\x00\x05~0\x82\x05z0\x82\x04b\xa0\x03\x02\x01\x02\x02\x08\x05?\xce\x9b\xa6\x80[\x000\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x0b\x05\x000b1\x1c0\x1a\x06\x03U\x04\x03\x13\x13Apple IST CA 2 - G11 0\x1e\x06\x03U\x04\x0b\x13\x17Certification Authority1\x130\x11\x06\x03U\x04\x0a\x13\x0aApple Inc.1\x0b0\x09\x06\x03U\x04\x06\x13\x02US0\x1e\x17\x0d150217144531Z\x17\x0d170318144531Z0u1\x150\x13\x06\x03U\x04\x03\x0c\x0c*.icloud.com1%0#\x06\x03U\x04\x0b\x0c\x1cmanagement:idms.group.5063641\x130\x11\x06\x03U\x04\x0a\x0c\x0aApple Inc.1\x130\x11\x06\x03U\x04\x08\x0c\x0aCalifornia1\x0b0\x09\x06\x03U\x04\x06\x13\x02US0\x82\x01"0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x01\x05\x00\x03\x82\x01\x0f\x000\x82\x01\x0a\x02\x82\x01\x01\x00\xb8+L\xa2[\xca\xcd\x02\x1a/\x8b]\xaci\xe6\x0f#L\x98W\x87\x88\x94\x02\xae\xd0\xf4F\x15\xb4\xc2\xa9y\xab\x1b2\xdcT\xea\x8d\xf5\xf5c\xa7KR\xde \x0f=\x13\x89\xf2\x1dd\x85vhE\xc3\xd9vJ\x0eJV\x19\xa7\x0c2\x08\xf8\x10t\xa5[\xdc\x0b\x83\x93\x89\x0d\xa9\xc5t~mUvn\xcaV\xc8D2\xe8\xb4\xa2\x02\xef\x7f*\xba\xb9x\xa8G\x82\x1f\xac\x8e\xff\x93\x00\xb9y&\x84"vU\xf5\x9f\xa8\x86\xe8~m\x0f\x80\x95(\x0d\x0a\xdfESHC\xf8\xeb\x13n\x98\xac\xd6\x96\x19~j\x15XtD|7\x7ft\xe7\x1e\x8a\x96uP\xc9\x97\x8c\xb1]6y\x90\xb2\x06H\xa3\xd2\xe2\xd8/\xcb\xe8\x13\xa0\xe2es9s\xe5u'\xbe\xf4F\xaa\xc2n"\xe0\x13\x1d\xc3\x04\x90XnP\x07Lh\xca/lN\xc6\xb6 \xa7*J\xc9g\xb3&\x94\x05\x14\xe2\x0cU\x1c\xdban*\xd8z\xec\x8cs5\x04\x975w\x9di(sr\x14\xd2>\xf3\x13\x02\x03\x01\x00\x01\xa3\x82\x02\x1f0\x82\x02\x1b0H\x06\x08+\x06\x01\x05\x05\x07\x01\x01\x04<0:08\x06\x08+\x06\x01\x05\x05\x070\x01\x86,http://ocsp.apple.com/ocsp04-appleistca2g1010\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14\x8eQ\xa1\x0e\x0a\x9b\x1c\x04\xf7Y\xd3i.#\x16\x91\x0e\xad\x06\xfb0\x0c\x06\x03U\x1d\x13\x01\x01\xff\x04\x020\x000\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14\xd8z\x94D|\x90p\x90\x16\x9e\xdd\x17\x9c\x01D\x03\x86\xd6*)0\x81\xff\x06\x03U\x1d \x04\x81\xf70\x81\xf40\x81\xf1\x06\x0a*\x86H\x86\xf7cd\x05\x0b\x040\x81\xe20\x81\xa4\x06\x08+\x06\x01\x05\x05\x07\x02\x020\x81\x97\x0c\x81\x94Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.09\x06\x08+\x06\x01\x05\x05\x07\x02\x01\x16-http://www.apple.com/certificateauthority/rpa07\x06\x03U\x1d\x1f\x0400.0,\xa0*\xa0(\x86&http://crl.apple.com/appleistca2g1.crl0\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x05\xa00\x1d\x06\x03U\x1d%\x04\x160\x14\x06\x08+\x06\x01\x05\x05\x07\x03\x01\x06\x08+\x06\x01\x05\x05\x07\x03\x020\x17\x06\x03U\x1d\x11\x04\x100\x0e\x82\x0c*.icloud.com0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x0b\x05\x00\x03\x82\x01\x01\x00@fi\xb2+\x8clA\xe2Bc\xde\x101\xa4.M\xc9 \xb3\x1c\xf3k)\xd1\x9eI\x17\xbf"\x8c\xcd\xb1H\x14\xd6\x8c\x8eO2\x84v`E\xbb(\x9cj\xea)\xd3\x191\xfb\x1ei\x9e\xd7\xf4\xb7\xa9\x1c\x92vY\xdeR*\xa2}>\x81d\x0dW\x07\xae\x17\x81{\xe2\x9c\x9fT-\x19\xe3c#\x8a\xfc\x08\xbb\x8eR\xf0-3\x81\x16bh\xaaY\x03\xcc\xd1\xea\x9e\xe6\xe6\xc11\xa0e\x02* \xad{\xdeI\x8fQ\x0f]\xf3"\x18\x19\xea\x04\x97y\x19\xa5\x9f#\xae\xaei\x84r6W\x93d\xe7\xdbF\xed\x8c\x13Yh\xb0g$\xfa\xaa,\xe4\xe7\xd7\xe7_G\x92\x14\xb2O\x0a\xc8Y\xa5\x9bx\xae\x88\xd1u\x19\xb6\x96\x88\x1a\xbf\xac\x91\x92\xc4B\x07\xc6 -1437831799.762680 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=301.0 msecs 527.97699 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=301.0 msecs 527.97699 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 1 @@ -8719,17 +8716,17 @@ [5] len: count = 1440 [6] payload: string = \x16\x03\x03\x0a$\x02\x00\x00M\x03\x03U\xb3\x92w\xe2RB\xdds\x11\xa9\xd4\x1d\xbc\x8e\xe2]\x09\xc5\xfc\xb1\xedl\xed\x17\xb2?a\xac\x81QM \x17x\xe5j\x19T\x12vWY\xcf\xf3\xeai\\xdf\x09[]\xb7\xdf.[\x0e\x04\xa8\x89bJ\x94\xa7\x0c\x00\x04\x00\x00\x05\xff\x01\x00\x01\x00\x0b\x00\x09\xcb\x00\x09\xc8\x00\x05~0\x82\x05z0\x82\x04b\xa0\x03\x02\x01\x02\x02\x08\x05?\xce\x9b\xa6\x80[\x000\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x0b\x05\x000b1\x1c0\x1a\x06\x03U\x04\x03\x13\x13Apple IST CA 2 - G11 0\x1e\x06\x03U\x04\x0b\x13\x17Certification Authority1\x130\x11\x06\x03U\x04\x0a\x13\x0aApple Inc.1\x0b0\x09\x06\x03U\x04\x06\x13\x02US0\x1e\x17\x0d150217144531Z\x17\x0d170318144531Z0u1\x150\x13\x06\x03U\x04\x03\x0c\x0c*.icloud.com1%0#\x06\x03U\x04\x0b\x0c\x1cmanagement:idms.group.5063641\x130\x11\x06\x03U\x04\x0a\x0c\x0aApple Inc.1\x130\x11\x06\x03U\x04\x08\x0c\x0aCalifornia1\x0b0\x09\x06\x03U\x04\x06\x13\x02US0\x82\x01"0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x01\x05\x00\x03\x82\x01\x0f\x000\x82\x01\x0a\x02\x82\x01\x01\x00\xb8+L\xa2[\xca\xcd\x02\x1a/\x8b]\xaci\xe6\x0f#L\x98W\x87\x88\x94\x02\xae\xd0\xf4F\x15\xb4\xc2\xa9y\xab\x1b2\xdcT\xea\x8d\xf5\xf5c\xa7KR\xde \x0f=\x13\x89\xf2\x1dd\x85vhE\xc3\xd9vJ\x0eJV\x19\xa7\x0c2\x08\xf8\x10t\xa5[\xdc\x0b\x83\x93\x89\x0d\xa9\xc5t~mUvn\xcaV\xc8D2\xe8\xb4\xa2\x02\xef\x7f*\xba\xb9x\xa8G\x82\x1f\xac\x8e\xff\x93\x00\xb9y&\x84"vU\xf5\x9f\xa8\x86\xe8~m\x0f\x80\x95(\x0d\x0a\xdfESHC\xf8\xeb\x13n\x98\xac\xd6\x96\x19~j\x15XtD|7\x7ft\xe7\x1e\x8a\x96uP\xc9\x97\x8c\xb1]6y\x90\xb2\x06H\xa3\xd2\xe2\xd8/\xcb\xe8\x13\xa0\xe2es9s\xe5u'\xbe\xf4F\xaa\xc2n"\xe0\x13\x1d\xc3\x04\x90XnP\x07Lh\xca/lN\xc6\xb6 \xa7*J\xc9g\xb3&\x94\x05\x14\xe2\x0cU\x1c\xdban*\xd8z\xec\x8cs5\x04\x975w\x9di(sr\x14\xd2>\xf3\x13\x02\x03\x01\x00\x01\xa3\x82\x02\x1f0\x82\x02\x1b0H\x06\x08+\x06\x01\x05\x05\x07\x01\x01\x04<0:08\x06\x08+\x06\x01\x05\x05\x070\x01\x86,http://ocsp.apple.com/ocsp04-appleistca2g1010\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14\x8eQ\xa1\x0e\x0a\x9b\x1c\x04\xf7Y\xd3i.#\x16\x91\x0e\xad\x06\xfb0\x0c\x06\x03U\x1d\x13\x01\x01\xff\x04\x020\x000\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14\xd8z\x94D|\x90p\x90\x16\x9e\xdd\x17\x9c\x01D\x03\x86\xd6*)0\x81\xff\x06\x03U\x1d \x04\x81\xf70\x81\xf40\x81\xf1\x06\x0a*\x86H\x86\xf7cd\x05\x0b\x040\x81\xe20\x81\xa4\x06\x08+\x06\x01\x05\x05\x07\x02\x020\x81\x97\x0c\x81\x94Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.09\x06\x08+\x06\x01\x05\x05\x07\x02\x01\x16-http://www.apple.com/certificateauthority/rpa07\x06\x03U\x1d\x1f\x0400.0,\xa0*\xa0(\x86&http://crl.apple.com/appleistca2g1.crl0\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x05\xa00\x1d\x06\x03U\x1d%\x04\x160\x14\x06\x08+\x06\x01\x05\x05\x07\x03\x01\x06\x08+\x06\x01\x05\x05\x07\x03\x020\x17\x06\x03U\x1d\x11\x04\x100\x0e\x82\x0c*.icloud.com0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x0b\x05\x00\x03\x82\x01\x01\x00@fi\xb2+\x8clA\xe2Bc\xde\x101\xa4.M\xc9 \xb3\x1c\xf3k)\xd1\x9eI\x17\xbf"\x8c\xcd\xb1H\x14\xd6\x8c\x8eO2\x84v`E\xbb(\x9cj\xea)\xd3\x191\xfb\x1ei\x9e\xd7\xf4\xb7\xa9\x1c\x92vY\xdeR*\xa2}>\x81d\x0dW\x07\xae\x17\x81{\xe2\x9c\x9fT-\x19\xe3c#\x8a\xfc\x08\xbb\x8eR\xf0-3\x81\x16bh\xaaY\x03\xcc\xd1\xea\x9e\xe6\xe6\xc11\xa0e\x02* \xad{\xdeI\x8fQ\x0f]\xf3"\x18\x19\xea\x04\x97y\x19\xa5\x9f#\xae\xaei\x84r6W\x93d\xe7\xdbF\xed\x8c\x13Yh\xb0g$\xfa\xaa,\xe4\xe7\xd7\xe7_G\x92\x14\xb2O\x0a\xc8Y\xa5\x9bx\xae\x88\xd1u\x19\xb6\x96\x88\x1a\xbf\xac\x91\x92\xc4B\x07\xc6 -1437831799.762680 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1494, cap_len=1494, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1480, id=50800, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319610144, ack=3289393581, hl=20, dl=1440, reserved=0, flags=24, win=2565], udp=, icmp=] -1437831799.762680 event_queue_flush_point -1437831799.762680 event_queue_flush_point -1437831799.762800 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=301.0 msecs 647.901535 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=301.0 msecs 647.901535 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=30539, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393581, ack=2319611584, hl=20, dl=0, reserved=0, flags=16, win=8147], udp=, icmp=] -1437831799.762800 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=301.0 msecs 647.901535 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=3, num_bytes_ip=345, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=1440, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=301.0 msecs 647.901535 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 202 @@ -8737,21 +8734,21 @@ [5] len: count = 0 [6] payload: string = -1437831799.762800 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=30539, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393581, ack=2319611584, hl=20, dl=0, reserved=0, flags=16, win=8147], udp=, icmp=] -1437831799.762800 event_queue_flush_point -1437831799.762800 event_queue_flush_point -1437831799.764576 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1201, id=50802, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319611584, ack=3289393581, hl=20, dl=1161, reserved=0, flags=24, win=2565], udp=, icmp=] -1437831799.764576 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x8a\x03 \x01a\xe0\xfc\xd4\x86\x8d\x14c\x08}~\x97o\xa7\x90\xbb\x98~\xe2\xa8\x8d\xfai\x9d\xd3\xabI\xa0D\xa8\xe6\xf8#\xae\xbb\xd2\xf5\xf1\x87\xe0\x88\x0f\xe9\xf5\x91\xbb58Y@\xf7\x82\xc1\x80{\x92\x90\xc3\x00\x04D0\x82\x04@0\x82\x03(\xa0\x03\x02\x01\x02\x02\x03\x02:t0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x0b\x05\x000B1\x0b0\x09\x06\x03U\x04\x06\x13\x02US1\x160\x14\x06\x03U\x04\x0a\x13\x0dGeoTrust Inc.1\x1b0\x19\x06\x03U\x04\x03\x13\x12GeoTrust Global CA0\x1e\x17\x0d140616154202Z\x17\x0d220520154202Z0b1\x1c0\x1a\x06\x03U\x04\x03\x13\x13Apple IST CA 2 - G11 0\x1e\x06\x03U\x04\x0b\x13\x17Certification Authority1\x130\x11\x06\x03U\x04\x0a\x13\x0aApple Inc.1\x0b0\x09\x06\x03U\x04\x06\x13\x02US0\x82\x01"0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x01\x05\x00\x03\x82\x01\x0f\x000\x82\x01\x0a\x02\x82\x01\x01\x00\xd0\x93\xa1\x1dGC \x16\xb2\x0bk\xeb\xc3\xd5\xb4\xe8\xc7\x98\xcd\xf3\xde\xbf\xe8M\xe9\xe36\x80\x07\xfcE\x1bj|E\x86\xaeV\xd3\xa4\x09\x7fa\x0dk]~Rk}\xb4\xc89\xc4\xf4g:\xf7\x83\xce\x19o\x86/~E~G\x1cgR\xca\x95\x05]\xe26Q\x85\xc0\xd4g\x805o\x15\xdd>\xfd\x1d\xd2\xfd\x8f4P\xd8\xecv*\xbe\xe3\xd3\xda\xe4\xfd\xc8\xeb(\x02\x96\x11\x97\x17a\x1c\xe9\xc4Y;B\xdc2\xd1\x09\x1d\xda\xa6\xd1C\x86\xff^\xb2\xbc\x8c\xcff\xdb\x01\x8b\x02\xae\x94H\xf38\x8f\xfd\xea2\xa8\x08\xec\x86\x97Q\x94$>II\x96S\xe8y\xa1@\x81\xe9\x05\xbb\x93\x95Q\xfc\xe3\xfd|\x11K\xf7\x9e\x08\xb3\x15I\x15\x07\xf9\xd17\xa0\x9bK2\xf6\xb5\xc4\xdcj\xd1\xfc\x0a\xed\xf6\xe0\xc5)\xa0\xa8\x8bq\xfe\x0d\x92\xbc\xfeTp\x18\x0am\xc7\xed\x0c\xfb\xc9-\x06\xc3\x8c\x85\xfc\xcb\x86\\xd66\x8e\x12\x8b\x09\x7f\xfb\x19\x1a8\xd5\xf0\x940z\x0f\xa6\x8c\xf3\x02\x03\x01\x00\x01\xa3\x82\x01\x1d0\x82\x01\x190\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14\xc0z\x98h\x8d\x89\xfb\xab\x05d\x0c\x11}\xaa}e\xb8\xca\xccN0\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14\xd8z\x94D|\x90p\x90\x16\x9e\xdd\x17\x9c\x01D\x03\x86\xd6*)0\x12\x06\x03U\x1d\x13\x01\x01\xff\x04\x080\x06\x01\x01\xff\x02\x01\x000\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x01\x0605\x06\x03U\x1d\x1f\x04.0,0*\xa0(\xa0&\x86$http://g.symcb.com/crls/gtglobal.crl0.\x06\x08+\x06\x01\x05\x05\x07\x01\x01\x04"0 0\x1e\x06\x08+\x06\x01\x05\x05\x070\x01\x86\x12http://g.symcd.com0L\x06\x03U\x1d \x04E0C0A\x06\x0a`\x86H\x01\x86\xf8E\x01\x0760301\x06\x08+\x06\x01\x05\x05\x07\x02\x01\x16%http://www.geotrust.com/resources/cps0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x0b\x05\x00\x03\x82\x01\x01\x00\x16Gso\x85\xa2b\xe1\xe7*v\xbb\x89\x95B&\x97\xbcJ\xac\xacpS:?1\x83=<\x1c\xab\x9a\xe2\xb1]\x1cv\x1a\xa0<\x0crW\xbe\xd3\x9eP\xe0\xc8\x99\xd6X\xd7\x02\xea\xce\x0d)T|\xcd\xf5\xc2\xc6\x90)U\xa3o\x14\xa8\x0bB\x0d:\x98m\x06x\x9e\xf0j\xa3\x1d\x02\x0a\xa2(\xa4\x8d\xc2\x81F>mg\xda\xde?\xfe\x85\x0eB*\x12\xde\xb5\xb7\xfb\xb8\x1b\xa7\x96\xecw\x9f\xec\xd4S\x95z\xff\x07\xf4\xf2\x0a\x14\xc0QR\xb1\xd6\x8eP\x0b\x1a\x99\\xbc\x0b\xc9\xbd\xed\xed\xf8^\xc1V\xdbM~#\xa4\x11\xa1,\xd4\x1b\x05\x9a\xe4\x1bR\xf6|8\x99\x05K\xbar\x8dB\x89`\x04f*\xf4\xfdh\xd7k\xf7\x99A(\xd6l$\xab\xe6%S.\xc8\x82\x99\xe2\xa2\x8f#\xbe0\x83\xb1'\x8b\xfah\x7f\x01I\xe8\xc6\x98k\x10.\x98^\x8a\xd7\xcaK\xb1\xc7\xc9X\x9a\xd06\xdb\x96\x95\xec\xb6\x81\xe4\xf2\xcdo\x1by\x87L\x10<\x89\xe4M\xfaT\xdc\xaa\xa6\x0e\x00\x00\x00 -1437831799.764576 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 1441 @@ -8759,222 +8756,222 @@ [5] len: count = 1161 [6] payload: string = \x8a\x03 \x01a\xe0\xfc\xd4\x86\x8d\x14c\x08}~\x97o\xa7\x90\xbb\x98~\xe2\xa8\x8d\xfai\x9d\xd3\xabI\xa0D\xa8\xe6\xf8#\xae\xbb\xd2\xf5\xf1\x87\xe0\x88\x0f\xe9\xf5\x91\xbb58Y@\xf7\x82\xc1\x80{\x92\x90\xc3\x00\x04D0\x82\x04@0\x82\x03(\xa0\x03\x02\x01\x02\x02\x03\x02:t0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x0b\x05\x000B1\x0b0\x09\x06\x03U\x04\x06\x13\x02US1\x160\x14\x06\x03U\x04\x0a\x13\x0dGeoTrust Inc.1\x1b0\x19\x06\x03U\x04\x03\x13\x12GeoTrust Global CA0\x1e\x17\x0d140616154202Z\x17\x0d220520154202Z0b1\x1c0\x1a\x06\x03U\x04\x03\x13\x13Apple IST CA 2 - G11 0\x1e\x06\x03U\x04\x0b\x13\x17Certification Authority1\x130\x11\x06\x03U\x04\x0a\x13\x0aApple Inc.1\x0b0\x09\x06\x03U\x04\x06\x13\x02US0\x82\x01"0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x01\x05\x00\x03\x82\x01\x0f\x000\x82\x01\x0a\x02\x82\x01\x01\x00\xd0\x93\xa1\x1dGC \x16\xb2\x0bk\xeb\xc3\xd5\xb4\xe8\xc7\x98\xcd\xf3\xde\xbf\xe8M\xe9\xe36\x80\x07\xfcE\x1bj|E\x86\xaeV\xd3\xa4\x09\x7fa\x0dk]~Rk}\xb4\xc89\xc4\xf4g:\xf7\x83\xce\x19o\x86/~E~G\x1cgR\xca\x95\x05]\xe26Q\x85\xc0\xd4g\x805o\x15\xdd>\xfd\x1d\xd2\xfd\x8f4P\xd8\xecv*\xbe\xe3\xd3\xda\xe4\xfd\xc8\xeb(\x02\x96\x11\x97\x17a\x1c\xe9\xc4Y;B\xdc2\xd1\x09\x1d\xda\xa6\xd1C\x86\xff^\xb2\xbc\x8c\xcff\xdb\x01\x8b\x02\xae\x94H\xf38\x8f\xfd\xea2\xa8\x08\xec\x86\x97Q\x94$>II\x96S\xe8y\xa1@\x81\xe9\x05\xbb\x93\x95Q\xfc\xe3\xfd|\x11K\xf7\x9e\x08\xb3\x15I\x15\x07\xf9\xd17\xa0\x9bK2\xf6\xb5\xc4\xdcj\xd1\xfc\x0a\xed\xf6\xe0\xc5)\xa0\xa8\x8bq\xfe\x0d\x92\xbc\xfeTp\x18\x0am\xc7\xed\x0c\xfb\xc9-\x06\xc3\x8c\x85\xfc\xcb\x86\\xd66\x8e\x12\x8b\x09\x7f\xfb\x19\x1a8\xd5\xf0\x940z\x0f\xa6\x8c\xf3\x02\x03\x01\x00\x01\xa3\x82\x01\x1d0\x82\x01\x190\x1f\x06\x03U\x1d#\x04\x180\x16\x80\x14\xc0z\x98h\x8d\x89\xfb\xab\x05d\x0c\x11}\xaa}e\xb8\xca\xccN0\x1d\x06\x03U\x1d\x0e\x04\x16\x04\x14\xd8z\x94D|\x90p\x90\x16\x9e\xdd\x17\x9c\x01D\x03\x86\xd6*)0\x12\x06\x03U\x1d\x13\x01\x01\xff\x04\x080\x06\x01\x01\xff\x02\x01\x000\x0e\x06\x03U\x1d\x0f\x01\x01\xff\x04\x04\x03\x02\x01\x0605\x06\x03U\x1d\x1f\x04.0,0*\xa0(\xa0&\x86$http://g.symcb.com/crls/gtglobal.crl0.\x06\x08+\x06\x01\x05\x05\x07\x01\x01\x04"0 0\x1e\x06\x08+\x06\x01\x05\x05\x070\x01\x86\x12http://g.symcd.com0L\x06\x03U\x1d \x04E0C0A\x06\x0a`\x86H\x01\x86\xf8E\x01\x0760301\x06\x08+\x06\x01\x05\x05\x07\x02\x01\x16%http://www.geotrust.com/resources/cps0\x0d\x06\x09*\x86H\x86\xf7\x0d\x01\x01\x0b\x05\x00\x03\x82\x01\x01\x00\x16Gso\x85\xa2b\xe1\xe7*v\xbb\x89\x95B&\x97\xbcJ\xac\xacpS:?1\x83=<\x1c\xab\x9a\xe2\xb1]\x1cv\x1a\xa0<\x0crW\xbe\xd3\x9eP\xe0\xc8\x99\xd6X\xd7\x02\xea\xce\x0d)T|\xcd\xf5\xc2\xc6\x90)U\xa3o\x14\xa8\x0bB\x0d:\x98m\x06x\x9e\xf0j\xa3\x1d\x02\x0a\xa2(\xa4\x8d\xc2\x81F>mg\xda\xde?\xfe\x85\x0eB*\x12\xde\xb5\xb7\xfb\xb8\x1b\xa7\x96\xecw\x9f\xec\xd4S\x95z\xff\x07\xf4\xf2\x0a\x14\xc0QR\xb1\xd6\x8eP\x0b\x1a\x99\\xbc\x0b\xc9\xbd\xed\xed\xf8^\xc1V\xdbM~#\xa4\x11\xa1,\xd4\x1b\x05\x9a\xe4\x1bR\xf6|8\x99\x05K\xbar\x8dB\x89`\x04f*\xf4\xfdh\xd7k\xf7\x99A(\xd6l$\xab\xe6%S.\xc8\x82\x99\xe2\xa2\x8f#\xbe0\x83\xb1'\x8b\xfah\x7f\x01I\xe8\xc6\x98k\x10.\x98^\x8a\xd7\xcaK\xb1\xc7\xc9X\x9a\xd06\xdb\x96\x95\xec\xb6\x81\xe4\xf2\xcdo\x1by\x87L\x10<\x89\xe4M\xfaT\xdc\xaa\xa6\x0e\x00\x00\x00 -1437831799.764576 ssl_extension - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_extension + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 65281 [3] val: string = \x00 -1437831799.764576 ssl_server_hello - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_server_hello + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=, version=, cipher=, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] version: count = 771 [2] record_version: count = 771 - [3] possible_ts: time = 1437831799.0 + [3] possible_ts: time = XXXXXXXXXX.XXXXXX [4] server_random: string = U\xb3\x92w\xe2RB\xdds\x11\xa9\xd4\x1d\xbc\x8e\xe2]\x09\xc5\xfc\xb1\xedl\xed\x17\xb2?a\xac\x81QM [5] session_id: string = \x17x\xe5j\x19T\x12vWY\xcf\xf3\xeai\\xdf\x09[]\xb7\xdf.[\x0e\x04\xa8\x89bJ\x94\xa7\x0c [6] cipher: count = 4 [7] comp_method: count = 0 -1437831799.764576 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] msg_type: count = 2 [3] length: count = 77 -1437831799.764576 file_new - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1437831799.764576 event_queue_flush_point -1437831799.764576 file_over_new_connection - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [2] is_orig: bool = F -1437831799.764576 event_queue_flush_point -1437831799.764576 file_sniff - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=, cert_chain_fuids=, client_cert_chain=, client_cert_chain_fuids=, subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=application/x-x509-user-cert, mime_types=, inferred=F] -1437831799.764576 event_queue_flush_point -1437831799.764576 file_hash - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = md5 [2] hash: string = 1bf9696d9f337805383427e88781d001 -1437831799.764576 file_hash - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = sha256 [2] hash: string = f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56 -1437831799.764576 x509_certificate - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_certificate + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] cert_ref: opaque of x509 = - [2] cert: X509::Certificate = [version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=] + [2] cert: X509::Certificate = [version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE] -1437831799.764576 x509_ext_basic_constraints - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_ext_basic_constraints + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=, extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::BasicConstraints = [ca=F, path_len=] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication] -1437831799.764576 x509_extension - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com] -1437831799.764576 x509_ext_subject_alternative_name - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_ext_subject_alternative_name + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=, basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::SubjectAlternativeName = [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F] -1437831799.764576 file_hash - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = sha1 [2] hash: string = f5ccb1a724133607548b00d8eb402efca3076d58 -1437831799.764576 file_state_remove - [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=FTerEX1QTrF67YJcA3, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1437831799.764576 file_new - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_new + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=, ftp=, http=, irc=, pe=] -1437831799.764576 event_queue_flush_point -1437831799.764576 X509::log_x509 - [0] rec: X509::Info = [ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX X509::log_x509 + [0] rec: X509::Info = [ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]] -1437831799.764576 Files::log_files - [0] rec: Files::Info = [ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=] +XXXXXXXXXX.XXXXXX Files::log_files + [0] rec: Files::Info = [ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=] -1437831799.764576 file_over_new_connection - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] - [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX file_over_new_connection + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0a}, rx_hosts={\x0a\x0a}, conn_uids={\x0a\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] + [1] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [2] is_orig: bool = F -1437831799.764576 event_queue_flush_point -1437831799.764576 file_sniff - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_sniff + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0a\x0a}, mime_type=, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] meta: fa_metadata = [mime_type=application/x-x509-ca-cert, mime_types=, inferred=F] -1437831799.764576 event_queue_flush_point -1437831799.764576 file_hash - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = md5 [2] hash: string = 48f0e38385112eeca5fc9ffd402eaecd -1437831799.764576 file_hash - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = sha256 [2] hash: string = ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b -1437831799.764576 x509_certificate - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_certificate + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=, extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=, extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] cert_ref: opaque of x509 = - [2] cert: X509::Certificate = [version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=] + [2] cert: X509::Certificate = [version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[], san=, basic_constraints=, extensions_cache=[]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0] -1437831799.764576 x509_ext_basic_constraints - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_ext_basic_constraints + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=, extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::BasicConstraints = [ca=T, path_len=0] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a] -1437831799.764576 x509_extension - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX x509_extension + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] ext: X509::Extension = [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a] -1437831799.764576 file_hash - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_hash + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] [1] kind: string = sha1 [2] hash: string = 8e8321ca08b08e3726fe1d82996884eeb5f0d655 -1437831799.764576 file_state_remove - [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=1437831799.764576, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] +XXXXXXXXXX.XXXXXX file_state_remove + [0] f: fa_file = [id=F58hAEwidvB37CYEf, parent_id=, source=SSL, is_orig=F, conns={\x0a\x09[[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp]] = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a\x09}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09\x09SSL::finalize_ssl\x0a\x09\x09{ \x0a\x09\x09if (!SSL::c?$ssl) \x0a\x09\x09\x09return ;\x0a\x0a\x09\x09if (!SSL::c$ssl$logged) \x0a\x09\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09\x09inline(SSL::c, F){{ \x0a\x09\x09SSL::log_record(SSL::c$ssl);\x0a\x09\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09\x09{ \x0a\x09\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x09\x09}\x0a\x09}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a\x09], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a\x09], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x09\x0917.167.150.73\x0a\x09}, rx_hosts={\x0a\x09\x09192.168.133.100\x0a\x09}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a\x09}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a\x09}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a\x09], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a\x09], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a\x09], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a\x09]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=]\x0a}, last_active=XXXXXXXXXX.XXXXXX, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timeout_interval=2.0 mins, bof_buffer_size=4096, bof_buffer=, info=[ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=0, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=], ftp=, http=, irc=, pe=] -1437831799.764576 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] msg_type: count = 11 [3] length: count = 2507 -1437831799.764576 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] msg_type: count = 14 [3] length: count = 0 -1437831799.764576 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=2, num_bytes_ip=1532, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 423.881531 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] record_version: count = 771 [3] content_type: count = 22 [4] length: count = 2596 -1437831799.764576 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1215, cap_len=1215, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1201, id=50802, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319611584, ack=3289393581, hl=20, dl=1161, reserved=0, flags=24, win=2565], udp=, icmp=] -1437831799.764576 event_queue_flush_point -1437831799.764576 X509::log_x509 - [0] rec: X509::Info = [ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX X509::log_x509 + [0] rec: X509::Info = [ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]] -1437831799.764576 Files::log_files - [0] rec: Files::Info = [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=] +XXXXXXXXXX.XXXXXX Files::log_files + [0] rec: Files::Info = [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=] -1437831799.764576 event_queue_flush_point -1437831799.764647 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 494.930267 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 494.930267 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=10474, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393581, ack=2319612745, hl=20, dl=0, reserved=0, flags=16, win=8155], udp=, icmp=] -1437831799.764647 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=303.0 msecs 494.930267 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=201, state=4, num_pkts=4, num_bytes_ip=385, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=303.0 msecs 494.930267 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 202 @@ -8982,21 +8979,21 @@ [5] len: count = 0 [6] payload: string = -1437831799.764647 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=10474, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393581, ack=2319612745, hl=20, dl=0, reserved=0, flags=16, win=8155], udp=, icmp=] -1437831799.764647 event_queue_flush_point -1437831799.764647 event_queue_flush_point -1437831799.838196 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=307, id=4791, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393581, ack=2319612745, hl=20, dl=267, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831799.838196 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x16\x03\x03\x01\x06\x10\x00\x01\x02\x01\x00A\x8e)<\xc0\xaa\xe4\x99\xac\xddGv\x1as~,u\x9c<\x0b\xb31\\x96\xff\x8b\x1f\xc1D+mnJ:\xa0s\x99\x10\xe0\xaf_d\xdfs\xa5\x1eQ\x7f\xd7\xd0\x04t7\x8e\x91\\x10\xb7\x07\x7f\xf7tz\xc0\xff:\xb3\xa1\xd1\xcb\x843\xa6w \xef\xf6\x959D\x04\xf1\x1f\x9d+ClXJ[\xda\x01\x9d\xc5\xac\xee\x81\x10\xad3\xd5\x8b.\xa5\xf2\x03\xacP\xdf\xc1\xcfB\xc6d\xe8\xe4O\xd0\x08\x88\x17#\x1c\xe2\xe4K\x94f\xfd\xca\x1a\x1c-H:RSU\xe5\x83\xd0&C\xfb\x10c\x19\xa0\xae\xf3Vi\xe7\x8a\xad\xa9j6]\xc7\xa5\xac\xea\x11|\xec\x0a\x8d\xb6\xadlF\xeeI\xa8\x12d.\xf8\xa6~\x1a5\xc5ba\x90\x11\x15"\xf4\x99\xf6t\xc0\x07\x06\xd5l\x91.\x11\x0b\xd7>\xf6\x97\x9cI\xc4\xf3\x1a\xf8\xc6\xe3\x18L#d\xea\x0c\x02\xa8\xe0-\xdaU\x04\x09\x9eh\xe1$\x10g\x09\x85\xc5w-\xabJ\xb1\xce\x84\xa4\xaf&\xa0\xbc\x94\xd9\xefg~\xa5 -1437831799.838196 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 202 @@ -9004,38 +9001,38 @@ [5] len: count = 267 [6] payload: string = \x16\x03\x03\x01\x06\x10\x00\x01\x02\x01\x00A\x8e)<\xc0\xaa\xe4\x99\xac\xddGv\x1as~,u\x9c<\x0b\xb31\\x96\xff\x8b\x1f\xc1D+mnJ:\xa0s\x99\x10\xe0\xaf_d\xdfs\xa5\x1eQ\x7f\xd7\xd0\x04t7\x8e\x91\\x10\xb7\x07\x7f\xf7tz\xc0\xff:\xb3\xa1\xd1\xcb\x843\xa6w \xef\xf6\x959D\x04\xf1\x1f\x9d+ClXJ[\xda\x01\x9d\xc5\xac\xee\x81\x10\xad3\xd5\x8b.\xa5\xf2\x03\xacP\xdf\xc1\xcfB\xc6d\xe8\xe4O\xd0\x08\x88\x17#\x1c\xe2\xe4K\x94f\xfd\xca\x1a\x1c-H:RSU\xe5\x83\xd0&C\xfb\x10c\x19\xa0\xae\xf3Vi\xe7\x8a\xad\xa9j6]\xc7\xa5\xac\xea\x11|\xec\x0a\x8d\xb6\xadlF\xeeI\xa8\x12d.\xf8\xa6~\x1a5\xc5ba\x90\x11\x15"\xf4\x99\xf6t\xc0\x07\x06\xd5l\x91.\x11\x0b\xd7>\xf6\x97\x9cI\xc4\xf3\x1a\xf8\xc6\xe3\x18L#d\xea\x0c\x02\xa8\xe0-\xdaU\x04\x09\x9eh\xe1$\x10g\x09\x85\xc5w-\xabJ\xb1\xce\x84\xa4\xaf&\xa0\xbc\x94\xd9\xefg~\xa5 -1437831799.838196 ssl_rsa_client_pms - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_rsa_client_pms + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] pms: string = \x01\x00A\x8e)<\xc0\xaa\xe4\x99\xac\xddGv\x1as~,u\x9c<\x0b\xb31\\x96\xff\x8b\x1f\xc1D+mnJ:\xa0s\x99\x10\xe0\xaf_d\xdfs\xa5\x1eQ\x7f\xd7\xd0\x04t7\x8e\x91\\x10\xb7\x07\x7f\xf7tz\xc0\xff:\xb3\xa1\xd1\xcb\x843\xa6w \xef\xf6\x959D\x04\xf1\x1f\x9d+ClXJ[\xda\x01\x9d\xc5\xac\xee\x81\x10\xad3\xd5\x8b.\xa5\xf2\x03\xacP\xdf\xc1\xcfB\xc6d\xe8\xe4O\xd0\x08\x88\x17#\x1c\xe2\xe4K\x94f\xfd\xca\x1a\x1c-H:RSU\xe5\x83\xd0&C\xfb\x10c\x19\xa0\xae\xf3Vi\xe7\x8a\xad\xa9j6]\xc7\xa5\xac\xea\x11|\xec\x0a\x8d\xb6\xadlF\xeeI\xa8\x12d.\xf8\xa6~\x1a5\xc5ba\x90\x11\x15"\xf4\x99\xf6t\xc0\x07\x06\xd5l\x91.\x11\x0b\xd7>\xf6\x97\x9cI\xc4\xf3\x1a\xf8\xc6\xe3\x18L#d\xea\x0c\x02\xa8\xe0-\xdaU\x04\x09\x9eh\xe1$\x10g\x09\x85\xc5w-\xabJ\xb1\xce\x84\xa4\xaf&\xa0\xbc\x94\xd9\xefg~\xa5 -1437831799.838196 ssl_handshake_message - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_handshake_message + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=F, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] msg_type: count = 16 [3] length: count = 258 -1437831799.838196 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=468, state=4, num_pkts=5, num_bytes_ip=425, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 43.962479 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] record_version: count = 771 [3] content_type: count = 22 [4] length: count = 262 -1437831799.838196 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=321, cap_len=321, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=307, id=4791, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393581, ack=2319612745, hl=20, dl=267, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831799.838196 event_queue_flush_point -1437831799.838196 event_queue_flush_point -1437831799.838197 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=46, id=53789, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393848, ack=2319612745, hl=20, dl=6, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831799.838197 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x14\x03\x03\x00\x01\x01 -1437831799.838197 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 469 @@ -9043,32 +9040,32 @@ [5] len: count = 6 [6] payload: string = \x14\x03\x03\x00\x01\x01 -1437831799.838197 ssl_change_cipher_spec - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_change_cipher_spec + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T -1437831799.838197 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=474, state=4, num_pkts=6, num_bytes_ip=732, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] record_version: count = 771 [3] content_type: count = 20 [4] length: count = 1 -1437831799.838197 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=60, cap_len=60, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=46, id=53789, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393848, ack=2319612745, hl=20, dl=6, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831799.838197 event_queue_flush_point -1437831799.838197 event_queue_flush_point -1437831799.838197 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=7, num_bytes_ip=778, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=7, num_bytes_ip=778, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=77, id=51331, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393854, ack=2319612745, hl=20, dl=37, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831799.838197 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=7, num_bytes_ip=778, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=7, num_bytes_ip=778, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x16\x03\x03\x00 \x1c\x1c\x84S/9\x14e\xb6'\xe5,\x03\x0fY\xdf\x1b\xcfu\xc84\xae\x1a"\xea]9j'\xbeZ\xa7 -1437831799.838197 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=7, num_bytes_ip=778, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=7, num_bytes_ip=778, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 475 @@ -9076,24 +9073,24 @@ [5] len: count = 37 [6] payload: string = \x16\x03\x03\x00 \x1c\x1c\x84S/9\x14e\xb6'\xe5,\x03\x0fY\xdf\x1b\xcfu\xc84\xae\x1a"\xea]9j'\xbeZ\xa7 -1437831799.838197 ssl_encrypted_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=7, num_bytes_ip=778, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_encrypted_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=7, num_bytes_ip=778, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=377.0 msecs 44.916153 usecs, service={\x0aSSL\x0a}, history=ShADd, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] record_version: count = 771 [3] content_type: count = 22 [4] length: count = 32 -1437831799.838197 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=91, cap_len=91, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=77, id=51331, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393854, ack=2319612745, hl=20, dl=37, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831799.838197 event_queue_flush_point -1437831799.838197 event_queue_flush_point -1437831800.045515 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 362.983704 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 362.983704 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=50803, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612745, ack=3289393848, hl=20, dl=0, reserved=0, flags=16, win=2908], udp=, icmp=] -1437831800.045515 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 362.983704 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=3, num_bytes_ip=2733, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 362.983704 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 2602 @@ -9101,17 +9098,17 @@ [5] len: count = 0 [6] payload: string = -1437831800.045515 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=50803, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612745, ack=3289393848, hl=20, dl=0, reserved=0, flags=16, win=2908], udp=, icmp=] -1437831800.045515 event_queue_flush_point -1437831800.045515 event_queue_flush_point -1437831800.045553 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=4, num_bytes_ip=2773, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 400.892258 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=4, num_bytes_ip=2773, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 400.892258 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=50804, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612745, ack=3289393854, hl=20, dl=0, reserved=0, flags=16, win=3268], udp=, icmp=] -1437831800.045553 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=4, num_bytes_ip=2773, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 400.892258 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=4, num_bytes_ip=2773, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 400.892258 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 2602 @@ -9119,17 +9116,17 @@ [5] len: count = 0 [6] payload: string = -1437831800.045553 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=50804, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612745, ack=3289393854, hl=20, dl=0, reserved=0, flags=16, win=3268], udp=, icmp=] -1437831800.045553 event_queue_flush_point -1437831800.045553 event_queue_flush_point -1437831800.045642 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=5, num_bytes_ip=2813, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 489.822388 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=5, num_bytes_ip=2813, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 489.822388 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=50805, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612745, ack=3289393891, hl=20, dl=0, reserved=0, flags=16, win=3626], udp=, icmp=] -1437831800.045642 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=5, num_bytes_ip=2813, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 489.822388 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2601, state=4, num_pkts=5, num_bytes_ip=2813, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 489.822388 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 2602 @@ -9137,21 +9134,21 @@ [5] len: count = 0 [6] payload: string = -1437831800.045642 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=50805, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612745, ack=3289393891, hl=20, dl=0, reserved=0, flags=16, win=3626], udp=, icmp=] -1437831800.045642 event_queue_flush_point -1437831800.045642 event_queue_flush_point -1437831800.045701 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=83, id=50807, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612745, ack=3289393891, hl=20, dl=43, reserved=0, flags=24, win=3626], udp=, icmp=] -1437831800.045701 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x14\x03\x03\x00\x01\x01\x16\x03\x03\x00 Z\x99\x17~d\x06\xbd;\xb4\xdf\xe2\xb3~9,|\xac\xdb\xb4\xeb\xcc\x95.\x17\xd2Q\x8a\x96\xdb\x13\x09! -1437831800.045701 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 2602 @@ -9159,41 +9156,41 @@ [5] len: count = 43 [6] payload: string = \x14\x03\x03\x00\x01\x01\x16\x03\x03\x00 Z\x99\x17~d\x06\xbd;\xb4\xdf\xe2\xb3~9,|\xac\xdb\xb4\xeb\xcc\x95.\x17\xd2Q\x8a\x96\xdb\x13\x09! -1437831800.045701 ssl_change_cipher_spec - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_change_cipher_spec + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F -1437831800.045701 ssl_plaintext_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_plaintext_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] record_version: count = 771 [3] content_type: count = 20 [4] length: count = 1 -1437831800.045701 ssl_established - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_established + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=35, established=F, logged=F, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=, issuer=, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.045701 ssl_encrypted_data - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX ssl_encrypted_data + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=6, num_bytes_ip=2853, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 548.950195 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] record_version: count = 771 [3] content_type: count = 22 [4] length: count = 32 -1437831800.045701 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=97, cap_len=97, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=83, id=50807, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612745, ack=3289393891, hl=20, dl=43, reserved=0, flags=24, win=3626], udp=, icmp=] -1437831800.045701 event_queue_flush_point -1437831800.045701 SSL::log_ssl - [0] rec: SSL::Info = [ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX SSL::log_ssl + [0] rec: SSL::Info = [ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0] -1437831800.045701 event_queue_flush_point -1437831800.045776 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 623.813629 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 623.813629 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=18678, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393891, ack=2319612788, hl=20, dl=0, reserved=0, flags=16, win=8190], udp=, icmp=] -1437831800.045776 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=584.0 msecs 623.813629 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=511, state=4, num_pkts=8, num_bytes_ip=855, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=584.0 msecs 623.813629 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 512 @@ -9201,21 +9198,21 @@ [5] len: count = 0 [6] payload: string = -1437831800.045776 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=18678, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393891, ack=2319612788, hl=20, dl=0, reserved=0, flags=16, win=8190], udp=, icmp=] -1437831800.045776 event_queue_flush_point -1437831800.045776 event_queue_flush_point -1437831800.047413 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=1132, state=4, num_pkts=9, num_bytes_ip=895, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=586.0 msecs 261.034012 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=1132, state=4, num_pkts=9, num_bytes_ip=895, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=586.0 msecs 261.034012 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=661, id=10957, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393891, ack=2319612788, hl=20, dl=621, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831800.047413 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=1132, state=4, num_pkts=9, num_bytes_ip=895, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=586.0 msecs 261.034012 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=1132, state=4, num_pkts=9, num_bytes_ip=895, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=586.0 msecs 261.034012 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x02h\xb3\xc7\xe1\xb6|\xfeW\xee]\xac/\xba\x97\x8ai\xcaK4\xaf\xb9V\xe4\xa0G\x95\xa7\x93\xc8K\x8d\x88\x82p\xbdA\x93U;B\xcf\x0c\x87\xc2\x90\x8a\x80?'\x18\xcc\xcb+\xd7\xec\x95\xcaWA?\xb8t\xe0\xe7?\xdbJ.E\xb1\xea\xa7\xcd\x9a\x1e{\xaf\xca(\x03\xb9j\xc8;5\xe4\xca\x1for\xe5\x13F\xff; \xac\xe9\x97E\xb5\xb9\xc3\x0a\x97\xd1"\xf4\x15\x96{q\xb4\x11\xf2\xe1<\x91\x1f\xc6'l\xbf\xb6\x17\xae\x17!F\xbc\xb2\xecD\xb8\xeeS\x13a\x97\xd7b\x9a?\xb0e\x1d\x8c\xd3x\xa6.\xe9\x9c)\xd0\xe7>\xf8\x96\xa5%\x1b\xe4YQ|\x93\xc1\xf9F\x8c\x07U\xe6/zL\xae\xc1@\x83[\x89k\xfbE\xcc?\xa47;\x0d\xa6Y\x98\x08\xa9\xe025e}_\xdbK\xdeZ\x1cE\xb7\xd9 'OD.w\xf2Ho\x96\x94\xd4M\x9d\x1b'\x05\x14\xd8\x0c2\xd6\xf3\x15\xf3'[\x9a\x94\xc9\x96\x99A\x1a]\x9b+\x17\x03k\x92\x9c\x8f\x99\xc5\xfbz\xaa\xc3\x88\xf8H\xcbV\xd054\xef\xdbH\xc2\x88\x11\xf3\xf8l\x0c6\x1e9\xa8;\xf9:\x0d\xd2qMN\xbb9+\xabL\x94}\xff\xbe\xe6\xef\xe7\xa6\x1b\xa2\xcd\xba\xee\x84\x87e\xf4&\xc3g\xb1?N$\xe1\xa4"\x09S8\xff\xa8\xbf\xba9\xf48\x1b\x7f[\xf2\xb2\xba\xbb<\x83\xb0\xc5\xefk\xb6k?\xbe\xfc,T\x1b\x9dX\xff\xe1\x91\x18\xd9U\x13W\x09\xa6\xd6\x8aNV+x\xc6\xa3g\x85\xe6\xd7>\xf6\x9a`$\xa5\xeaA\x16\x0a\xc7u\xe4\x00\xdb\x987.2\x8a\xef\x8a\x86{\x17\x06E\x88\x12\xc8B\x04\x97\xe0\xec\xe3vBQ\x15\x81O.\xbc\xc6D\xfa2\xa6v\x1b\x0dle\xfc\xef(]\x9dI\x18"\xd4\xd1\x8e\xbaR\xa6\x17\xb7THv}\xb4]\xae&\x0f{\xd6C\x8b\x92d\xee\xd9\xb68.]\x08uP\xb6^AZ\x0e-E.\xb9\xadn\x05\x7f\xd5\x14\xa8%F)\x84\xa1v\xda\xa0/C\xc8\xf9\x1fAo;\xb1\xffd\xb0\xdfG\xeaT\x940\xdb#\xe2\xdbp\x86s&RJt\xc6\xb1iB\xe8F5\xe2\x83.I\x03\x1dV\x1cs\xcf\xb5\x88\xcf\x13h%\x8a\xbe\xdc\xaa\xc4r3\xc3\x06tj\xf6\x96R\x8a\xf3\x90\xa63\x9c[J\xff\x1c]1\x974d\x0b#O\xc72\x00\x92b"\x1f\x14y\x05A\x85k\x16\x03\x8cB\xf3\xfb\xc4\xf9\xd4\x1f3>\xa2\x9c\xba\x08e\xd67\x00sL\x99\x9fW -1437831800.047413 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=1132, state=4, num_pkts=9, num_bytes_ip=895, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=586.0 msecs 261.034012 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=1132, state=4, num_pkts=9, num_bytes_ip=895, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=586.0 msecs 261.034012 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 512 @@ -9223,21 +9220,21 @@ [5] len: count = 621 [6] payload: string = \x17\x03\x03\x02h\xb3\xc7\xe1\xb6|\xfeW\xee]\xac/\xba\x97\x8ai\xcaK4\xaf\xb9V\xe4\xa0G\x95\xa7\x93\xc8K\x8d\x88\x82p\xbdA\x93U;B\xcf\x0c\x87\xc2\x90\x8a\x80?'\x18\xcc\xcb+\xd7\xec\x95\xcaWA?\xb8t\xe0\xe7?\xdbJ.E\xb1\xea\xa7\xcd\x9a\x1e{\xaf\xca(\x03\xb9j\xc8;5\xe4\xca\x1for\xe5\x13F\xff; \xac\xe9\x97E\xb5\xb9\xc3\x0a\x97\xd1"\xf4\x15\x96{q\xb4\x11\xf2\xe1<\x91\x1f\xc6'l\xbf\xb6\x17\xae\x17!F\xbc\xb2\xecD\xb8\xeeS\x13a\x97\xd7b\x9a?\xb0e\x1d\x8c\xd3x\xa6.\xe9\x9c)\xd0\xe7>\xf8\x96\xa5%\x1b\xe4YQ|\x93\xc1\xf9F\x8c\x07U\xe6/zL\xae\xc1@\x83[\x89k\xfbE\xcc?\xa47;\x0d\xa6Y\x98\x08\xa9\xe025e}_\xdbK\xdeZ\x1cE\xb7\xd9 'OD.w\xf2Ho\x96\x94\xd4M\x9d\x1b'\x05\x14\xd8\x0c2\xd6\xf3\x15\xf3'[\x9a\x94\xc9\x96\x99A\x1a]\x9b+\x17\x03k\x92\x9c\x8f\x99\xc5\xfbz\xaa\xc3\x88\xf8H\xcbV\xd054\xef\xdbH\xc2\x88\x11\xf3\xf8l\x0c6\x1e9\xa8;\xf9:\x0d\xd2qMN\xbb9+\xabL\x94}\xff\xbe\xe6\xef\xe7\xa6\x1b\xa2\xcd\xba\xee\x84\x87e\xf4&\xc3g\xb1?N$\xe1\xa4"\x09S8\xff\xa8\xbf\xba9\xf48\x1b\x7f[\xf2\xb2\xba\xbb<\x83\xb0\xc5\xefk\xb6k?\xbe\xfc,T\x1b\x9dX\xff\xe1\x91\x18\xd9U\x13W\x09\xa6\xd6\x8aNV+x\xc6\xa3g\x85\xe6\xd7>\xf6\x9a`$\xa5\xeaA\x16\x0a\xc7u\xe4\x00\xdb\x987.2\x8a\xef\x8a\x86{\x17\x06E\x88\x12\xc8B\x04\x97\xe0\xec\xe3vBQ\x15\x81O.\xbc\xc6D\xfa2\xa6v\x1b\x0dle\xfc\xef(]\x9dI\x18"\xd4\xd1\x8e\xbaR\xa6\x17\xb7THv}\xb4]\xae&\x0f{\xd6C\x8b\x92d\xee\xd9\xb68.]\x08uP\xb6^AZ\x0e-E.\xb9\xadn\x05\x7f\xd5\x14\xa8%F)\x84\xa1v\xda\xa0/C\xc8\xf9\x1fAo;\xb1\xffd\xb0\xdfG\xeaT\x940\xdb#\xe2\xdbp\x86s&RJt\xc6\xb1iB\xe8F5\xe2\x83.I\x03\x1dV\x1cs\xcf\xb5\x88\xcf\x13h%\x8a\xbe\xdc\xaa\xc4r3\xc3\x06tj\xf6\x96R\x8a\xf3\x90\xa63\x9c[J\xff\x1c]1\x974d\x0b#O\xc72\x00\x92b"\x1f\x14y\x05A\x85k\x16\x03\x8cB\xf3\xfb\xc4\xf9\xd4\x1f3>\xa2\x9c\xba\x08e\xd67\x00sL\x99\x9fW -1437831800.047413 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=675, cap_len=675, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=661, id=10957, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289393891, ack=2319612788, hl=20, dl=621, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831800.047413 event_queue_flush_point -1437831800.047413 event_queue_flush_point -1437831800.047518 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=10, num_bytes_ip=1556, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=586.0 msecs 365.938187 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=10, num_bytes_ip=1556, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=586.0 msecs 365.938187 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=1157, id=57830, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289394512, ack=2319612788, hl=20, dl=1117, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831800.047518 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=10, num_bytes_ip=1556, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=586.0 msecs 365.938187 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=10, num_bytes_ip=1556, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=586.0 msecs 365.938187 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x04X<,@\xce{\xe2\xed\x1d\xe7\xec\\\x96RT\x94y\xa4\xa8%,\xb5X\xe2X\xc0$\x0e\xf1\xde\x0d\xd0C\xc3_\xa84H?\x93\x13\xeb\x89\x12\x98\xa0\xd0\xf6\xbayU\xfd\xf4T\xf6Qb\xa1\xc5j\xe8\xcc9\xb5\xfd\xbds\xf7CT\xbe\xaa\xaa\x14V\x8c\x0aC9&&\x05\xe6\xd8\x8c\xacVbCF\x0f\xc7A\x01^\xd2\x15\x18\xaa\xf8\xdfI\xf8.v\x08Q\xb3K\xfe\xa0\x84\xe5\x93Y\xd9T:\x8c^\xe1\xe5\xf6BY}A=\xee\x970n\xddE;m\x01\xdb,t\x14\xed/\x9a\xdeU\xe7\x92_\xa3\x88\xc8`\xf6n\x0e-\xd5\xd82\xb3\xd8[\xf1\xf5fey\xdb\xab\xfeN\xe9\x94\xf6#\xac\xbd\x9b\xf7\xde\xfb\x17\xf9\x8c\x97\x8f:\xdf\x87KQpK\x93\xb4\xb2r0\xe39\xc2\x85\x8d\x95)\x19le\xdb\xd4S\xb3\x85\xcb\xa7\x96\x1e\x00\xba\xee\x0f\x01\xb6mNf\x82uAH\xba\xa6\xef\xdch\x1c*\x97C\xe5\xc3>\x91^\xc8\xe0S\x07\x96\x02\x94z{\x87\x0f\x9c\xc5\xcd\x009\x09K<\xe7 T\x8d\xda\xce\xca\x00ea*v2\x83\xfd\xef\x8d2\xcd0J\xff\x0ad\xcd\x8a\x9el\x90\x02\xfe\xc8\x9c%<\xa4\xed\x1c\xac \x8c\xf4\xe5\x9c\x9c^\x0cJ\xb4\x06\xff\xc6#\x07=\xe299!Q\x13\xf1\xdb\xc1\xfe\xa6&\xd7D};Y\xechBD(\x81\x9c\x8c\xd6\x80\xaa{uA\xfcj\xa3\xd0Vq\xb4Z\x01\xb3\xc4\x9f\x9d\xb9\xc0\xe4`}\xb2\x01o\xf9\xe4\x87\xbe\xd0\x94_\xba0\xffN\x82E\x1c\xc9\xc9\x8d\xae\xd5{\x9fIkV\x98\x81\xed\x00\xbeo\xe9\x97\xc7\x07B\xb4\\xcd\xfb\x94h\xde\x0d\xe6M\x8eb\x94\xa1\x04V\x89\xc5\x0e\xd8\xc7}\xc2\x0f8\xaf\xd0a\xef\xdf\xac\x9c1~\x04\x109\x0ef\xa7_\xe0\xa1RF<\x94\xc2O\xebT,\xde7\xf7\x19\xb1\xf3\x91\xba#\xf4\x98Y\x9d"l\xa6\xf8\xb3\xfd\xc6\xcb\xf6+t\x00\xd7\xb9\xe8S\xb5a\xc5K\xd6c\xe9\xe7\xcd2\xe1b\x8f\xfbe\xf1u\xb2Wa\x0eE\xe0\x85\xe8h\x8e8\x90\xd3\x83i\xbf\x8dOK5\xc6\xba\x1a;\x1bt\xbb\x85\x90\x1b\xcf\x10g\x9f\x81\x96N\xca\x81\xb5{C\xf2G\xd4]\xf3\xc9Q\x85M\x1e/5{N!\x18\xd6%\xbby\x03\xb1mc\xd4\x92\x15\x8f\x09\xc3\xf6Z\xaa,\xa3z\xd3\x97D\xf8\xf0\x82\x14\xad\xa7\x0aFs\xa0\xfbU\x84\xea\x14^\x1f{\x0a\x91[\xcc\x97\x87\x9a\x82p\xffu,\xcd\xa1\xd5\x1a\xa4_:\xfd_\xcd\xe5i\xcc\x0c=\x93"e\x19\xab\x83\xbbr\xa9\x1e\x92\xc2Bg\xd0\x8f\xef\x85\xd0\x9b\xdc\x09B\xd2C\x09\x8c\xb8\xf3\xc9\xf7F\xd0\x8c\xf5sb\xc5\x070~\xe0\xb0\xe7y\x1d\xe6\xdf\xb1G\xa3Vi\x91\x0fg\xce\xd1\x86\xb7\x99\x90rT\xa0(\xcf\x9eT\x18\xa4\xb4=\x16\x1e-j\x19}\x9bS\xd1\x10e9\xcc\xbe1O\xcb\xb1\xa6\xc5WT\xb8A\xc3\x13\xf3\x13ra\xf3O\xea\xe9\xa1\xea\xb1\x0f\xa3\xce^\xbd\xe9\x93,\x8ao\xf3y\xd2\xf7\xba$\x92oX\xb2(\xea\x94\xbd\xeb}\x08 \x85\xe4$1tK\xda(\xfa\xdd\xcdX9\xa4L\xdb\x19k\x12T\xa8\xe6@\xf55\xa0\x85@\xec\x9dD\xe6SK\xbc@\x05\x93*-z\x17]\xe6\x13l`\x13f\x0a\xf18\xdbvkU\x90\xe6\x88S\x9b\x85)\x9fa`\x08\xea\xe5Q\x96\x04\xf1fe\xdei\xbd\xc9\xb3x\xff7\xd2\x0f6\x82YA\xf1_\x04x\x81QMf\xe6uD%\x95\x7f\xf6ph\xbf\x7f\xa6\xea\x98\x8f\x1f\xa6\x18.\xdeh\xd1\x94\xa9k\x13\x0a\x12\xaf\x9c\xe2\xd6\x96\x05\x9e\xb1\xc3\xcaEx\xb8c\xbf\xa1\xaa38g\xa7\x0d\xc0\x99\x83\xbc1<\x0c}\xb9#\x0c\x1a\xb3\x0e\xc4X?`\x15\x8e\xcc\xb9\xa1F#\xb5\x84N3\xc9\xcd\xb4\xf3\x0a{5\xcd\x1a\xd5f\xf8*\xef\x1e\x16\xc1\xef\xea|!\xe9\xaapy&~qx\xaa\xbeY\xa0X\x92'\x83\x89\xf5s\xa5\xeb\x8f&At\x93j\xcc\xe7\xb8(C\x9d -1437831800.047518 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=10, num_bytes_ip=1556, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=586.0 msecs 365.938187 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=10, num_bytes_ip=1556, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=586.0 msecs 365.938187 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = AP [3] seq: count = 1133 @@ -9245,17 +9242,17 @@ [5] len: count = 1117 [6] payload: string = \x17\x03\x03\x04X<,@\xce{\xe2\xed\x1d\xe7\xec\\\x96RT\x94y\xa4\xa8%,\xb5X\xe2X\xc0$\x0e\xf1\xde\x0d\xd0C\xc3_\xa84H?\x93\x13\xeb\x89\x12\x98\xa0\xd0\xf6\xbayU\xfd\xf4T\xf6Qb\xa1\xc5j\xe8\xcc9\xb5\xfd\xbds\xf7CT\xbe\xaa\xaa\x14V\x8c\x0aC9&&\x05\xe6\xd8\x8c\xacVbCF\x0f\xc7A\x01^\xd2\x15\x18\xaa\xf8\xdfI\xf8.v\x08Q\xb3K\xfe\xa0\x84\xe5\x93Y\xd9T:\x8c^\xe1\xe5\xf6BY}A=\xee\x970n\xddE;m\x01\xdb,t\x14\xed/\x9a\xdeU\xe7\x92_\xa3\x88\xc8`\xf6n\x0e-\xd5\xd82\xb3\xd8[\xf1\xf5fey\xdb\xab\xfeN\xe9\x94\xf6#\xac\xbd\x9b\xf7\xde\xfb\x17\xf9\x8c\x97\x8f:\xdf\x87KQpK\x93\xb4\xb2r0\xe39\xc2\x85\x8d\x95)\x19le\xdb\xd4S\xb3\x85\xcb\xa7\x96\x1e\x00\xba\xee\x0f\x01\xb6mNf\x82uAH\xba\xa6\xef\xdch\x1c*\x97C\xe5\xc3>\x91^\xc8\xe0S\x07\x96\x02\x94z{\x87\x0f\x9c\xc5\xcd\x009\x09K<\xe7 T\x8d\xda\xce\xca\x00ea*v2\x83\xfd\xef\x8d2\xcd0J\xff\x0ad\xcd\x8a\x9el\x90\x02\xfe\xc8\x9c%<\xa4\xed\x1c\xac \x8c\xf4\xe5\x9c\x9c^\x0cJ\xb4\x06\xff\xc6#\x07=\xe299!Q\x13\xf1\xdb\xc1\xfe\xa6&\xd7D};Y\xechBD(\x81\x9c\x8c\xd6\x80\xaa{uA\xfcj\xa3\xd0Vq\xb4Z\x01\xb3\xc4\x9f\x9d\xb9\xc0\xe4`}\xb2\x01o\xf9\xe4\x87\xbe\xd0\x94_\xba0\xffN\x82E\x1c\xc9\xc9\x8d\xae\xd5{\x9fIkV\x98\x81\xed\x00\xbeo\xe9\x97\xc7\x07B\xb4\\xcd\xfb\x94h\xde\x0d\xe6M\x8eb\x94\xa1\x04V\x89\xc5\x0e\xd8\xc7}\xc2\x0f8\xaf\xd0a\xef\xdf\xac\x9c1~\x04\x109\x0ef\xa7_\xe0\xa1RF<\x94\xc2O\xebT,\xde7\xf7\x19\xb1\xf3\x91\xba#\xf4\x98Y\x9d"l\xa6\xf8\xb3\xfd\xc6\xcb\xf6+t\x00\xd7\xb9\xe8S\xb5a\xc5K\xd6c\xe9\xe7\xcd2\xe1b\x8f\xfbe\xf1u\xb2Wa\x0eE\xe0\x85\xe8h\x8e8\x90\xd3\x83i\xbf\x8dOK5\xc6\xba\x1a;\x1bt\xbb\x85\x90\x1b\xcf\x10g\x9f\x81\x96N\xca\x81\xb5{C\xf2G\xd4]\xf3\xc9Q\x85M\x1e/5{N!\x18\xd6%\xbby\x03\xb1mc\xd4\x92\x15\x8f\x09\xc3\xf6Z\xaa,\xa3z\xd3\x97D\xf8\xf0\x82\x14\xad\xa7\x0aFs\xa0\xfbU\x84\xea\x14^\x1f{\x0a\x91[\xcc\x97\x87\x9a\x82p\xffu,\xcd\xa1\xd5\x1a\xa4_:\xfd_\xcd\xe5i\xcc\x0c=\x93"e\x19\xab\x83\xbbr\xa9\x1e\x92\xc2Bg\xd0\x8f\xef\x85\xd0\x9b\xdc\x09B\xd2C\x09\x8c\xb8\xf3\xc9\xf7F\xd0\x8c\xf5sb\xc5\x070~\xe0\xb0\xe7y\x1d\xe6\xdf\xb1G\xa3Vi\x91\x0fg\xce\xd1\x86\xb7\x99\x90rT\xa0(\xcf\x9eT\x18\xa4\xb4=\x16\x1e-j\x19}\x9bS\xd1\x10e9\xcc\xbe1O\xcb\xb1\xa6\xc5WT\xb8A\xc3\x13\xf3\x13ra\xf3O\xea\xe9\xa1\xea\xb1\x0f\xa3\xce^\xbd\xe9\x93,\x8ao\xf3y\xd2\xf7\xba$\x92oX\xb2(\xea\x94\xbd\xeb}\x08 \x85\xe4$1tK\xda(\xfa\xdd\xcdX9\xa4L\xdb\x19k\x12T\xa8\xe6@\xf55\xa0\x85@\xec\x9dD\xe6SK\xbc@\x05\x93*-z\x17]\xe6\x13l`\x13f\x0a\xf18\xdbvkU\x90\xe6\x88S\x9b\x85)\x9fa`\x08\xea\xe5Q\x96\x04\xf1fe\xdei\xbd\xc9\xb3x\xff7\xd2\x0f6\x82YA\xf1_\x04x\x81QMf\xe6uD%\x95\x7f\xf6ph\xbf\x7f\xa6\xea\x98\x8f\x1f\xa6\x18.\xdeh\xd1\x94\xa9k\x13\x0a\x12\xaf\x9c\xe2\xd6\x96\x05\x9e\xb1\xc3\xcaEx\xb8c\xbf\xa1\xaa38g\xa7\x0d\xc0\x99\x83\xbc1<\x0c}\xb9#\x0c\x1a\xb3\x0e\xc4X?`\x15\x8e\xcc\xb9\xa1F#\xb5\x84N3\xc9\xcd\xb4\xf3\x0a{5\xcd\x1a\xd5f\xf8*\xef\x1e\x16\xc1\xef\xea|!\xe9\xaapy&~qx\xaa\xbeY\xa0X\x92'\x83\x89\xf5s\xa5\xeb\x8f&At\x93j\xcc\xe7\xb8(C\x9d -1437831800.047518 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=1171, cap_len=1171, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=1157, id=57830, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289394512, ack=2319612788, hl=20, dl=1117, reserved=0, flags=24, win=8192], udp=, icmp=] -1437831800.047518 event_queue_flush_point -1437831800.047518 event_queue_flush_point -1437831800.196803 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=735.0 msecs 651.016235 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=735.0 msecs 651.016235 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=50808, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612788, ack=3289394512, hl=20, dl=0, reserved=0, flags=16, win=3947], udp=, icmp=] -1437831800.196803 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=735.0 msecs 651.016235 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=7, num_bytes_ip=2936, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=735.0 msecs 651.016235 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 2645 @@ -9263,17 +9260,17 @@ [5] len: count = 0 [6] payload: string = -1437831800.196803 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=50808, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612788, ack=3289394512, hl=20, dl=0, reserved=0, flags=16, win=3947], udp=, icmp=] -1437831800.196803 event_queue_flush_point -1437831800.196803 event_queue_flush_point -1437831800.197167 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=8, num_bytes_ip=2976, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=736.0 msecs 14.842987 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=8, num_bytes_ip=2976, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=736.0 msecs 14.842987 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=50809, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612788, ack=3289395629, hl=20, dl=0, reserved=0, flags=16, win=4237], udp=, icmp=] -1437831800.197167 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=8, num_bytes_ip=2976, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=736.0 msecs 14.842987 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=2644, state=4, num_pkts=8, num_bytes_ip=2976, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=736.0 msecs 14.842987 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = A [3] seq: count = 2645 @@ -9281,21 +9278,21 @@ [5] len: count = 0 [6] payload: string = -1437831800.197167 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=50809, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612788, ack=3289395629, hl=20, dl=0, reserved=0, flags=16, win=4237], udp=, icmp=] -1437831800.197167 event_queue_flush_point -1437831800.197167 event_queue_flush_point -1437831800.217047 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=9, num_bytes_ip=3016, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=755.0 msecs 894.899368 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=9, num_bytes_ip=3016, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=755.0 msecs 894.899368 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=427, id=50811, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612788, ack=3289395629, hl=20, dl=387, reserved=0, flags=24, win=4237], udp=, icmp=] -1437831800.217047 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=9, num_bytes_ip=3016, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=755.0 msecs 894.899368 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=9, num_bytes_ip=3016, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=755.0 msecs 894.899368 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x01~^\x0a\x11^Z\xfb\x1e\x9fV2\x00V\xa4\x7fkj.\x97\xc8\xd7\xbc1\xf5M\xd5\x06\xb6y\xca\xd3\x12#\\x87\xa9\x1d\xad\xbe\xd0\xbe\x88\xb2\x99\x1b\x16mb!\xed\xd0^\x04]\x85\xbdw\x8d\x94\xad!\xea\x08~}\x06\x09\x97\x8c\xf3H\xa0\x10'\x14^977\xf5J\xee\xf7G\xaeV_\xe9\xbdx,\xb4\xb7\xa7\xe7u\xdd\xff\xa4\xf5\x9a\xe8z~Y\x12.\xdb\x1d\x0e\x0c\xe5k\xd9/\xee\xd0;\x94<\xf9~QT\xc7?\xac_\xb3\xae\xd9\x0e;\x1c\xa7\x82\xdavy\xb0\xe8\x1a\xa3\xc6\xdf\x8c\xec\xb4\xe9^\x97\xca\xce\x06\xf3m\x15Nd\x96\xb5-c\xdd(\x9f\xed\x0ag\x05s\xbd\xc3v\x00'\x1b\x86j<@\xb6\xed\x88\x1fZI\x809-GKAu\xb2>" \xa0I\xa90\xbc\x83\xcb\x9f\xd5~\xf0n\xef\xe7\xf3\x7f\x93s0\xc4\xa3\x83\xd8J\x1fPsjx\x83\xe3p\xe6b\x99\xd2\x8d\xa6qV\xbe\xef\x8c\xfc\xed-\xebvLg\xf1\xe5L\xe4\x12\x8c9\x9e\x10%%k\x17\xc9\x8c%=1!\xd7\x08\xc3\xa3r\xe6\xda\xc7\xba\xb4\x7f}\xf9\x15\xfd\xef\xe1\xd0\xb0\x0a\x0a!AT6%\xf8\x1a|\x85\xe5\xd5\x0d\x1a\xad\xb4\x8c\xd4\x123\x80d4s\x15\x0d3\xb4\x83\xe7\xa7,l0\x9dSq:\x1c\x9d\x09&~Q\xc7'u\xe8}Qj\x88\xc3\xcd\x7ft\x80\xcc\xb8\\xfc{\xcb\xaa\xa9\x99xaS\x0c\xab\x81\xfe'}`J\xd4a6\xcb\xe0D\x12\xfa\xbd\x02\xbc\x0c\xc0\x1b\x14Q\x9a\xbd\xd9 -1437831800.217047 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=9, num_bytes_ip=3016, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=755.0 msecs 894.899368 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=9, num_bytes_ip=3016, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=755.0 msecs 894.899368 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 2645 @@ -9303,17 +9300,17 @@ [5] len: count = 387 [6] payload: string = \x17\x03\x03\x01~^\x0a\x11^Z\xfb\x1e\x9fV2\x00V\xa4\x7fkj.\x97\xc8\xd7\xbc1\xf5M\xd5\x06\xb6y\xca\xd3\x12#\\x87\xa9\x1d\xad\xbe\xd0\xbe\x88\xb2\x99\x1b\x16mb!\xed\xd0^\x04]\x85\xbdw\x8d\x94\xad!\xea\x08~}\x06\x09\x97\x8c\xf3H\xa0\x10'\x14^977\xf5J\xee\xf7G\xaeV_\xe9\xbdx,\xb4\xb7\xa7\xe7u\xdd\xff\xa4\xf5\x9a\xe8z~Y\x12.\xdb\x1d\x0e\x0c\xe5k\xd9/\xee\xd0;\x94<\xf9~QT\xc7?\xac_\xb3\xae\xd9\x0e;\x1c\xa7\x82\xdavy\xb0\xe8\x1a\xa3\xc6\xdf\x8c\xec\xb4\xe9^\x97\xca\xce\x06\xf3m\x15Nd\x96\xb5-c\xdd(\x9f\xed\x0ag\x05s\xbd\xc3v\x00'\x1b\x86j<@\xb6\xed\x88\x1fZI\x809-GKAu\xb2>" \xa0I\xa90\xbc\x83\xcb\x9f\xd5~\xf0n\xef\xe7\xf3\x7f\x93s0\xc4\xa3\x83\xd8J\x1fPsjx\x83\xe3p\xe6b\x99\xd2\x8d\xa6qV\xbe\xef\x8c\xfc\xed-\xebvLg\xf1\xe5L\xe4\x12\x8c9\x9e\x10%%k\x17\xc9\x8c%=1!\xd7\x08\xc3\xa3r\xe6\xda\xc7\xba\xb4\x7f}\xf9\x15\xfd\xef\xe1\xd0\xb0\x0a\x0a!AT6%\xf8\x1a|\x85\xe5\xd5\x0d\x1a\xad\xb4\x8c\xd4\x123\x80d4s\x15\x0d3\xb4\x83\xe7\xa7,l0\x9dSq:\x1c\x9d\x09&~Q\xc7'u\xe8}Qj\x88\xc3\xcd\x7ft\x80\xcc\xb8\\xfc{\xcb\xaa\xa9\x99xaS\x0c\xab\x81\xfe'}`J\xd4a6\xcb\xe0D\x12\xfa\xbd\x02\xbc\x0c\xc0\x1b\x14Q\x9a\xbd\xd9 -1437831800.217047 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=441, cap_len=441, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=427, id=50811, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319612788, ack=3289395629, hl=20, dl=387, reserved=0, flags=24, win=4237], udp=, icmp=] -1437831800.217047 event_queue_flush_point -1437831800.217047 event_queue_flush_point -1437831800.217152 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 0.041962 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 0.041962 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=57216, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289395629, ack=2319613175, hl=20, dl=0, reserved=0, flags=16, win=8179], udp=, icmp=] -1437831800.217152 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 0.041962 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=11, num_bytes_ip=2713, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3031, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 0.041962 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 2250 @@ -9321,21 +9318,21 @@ [5] len: count = 0 [6] payload: string = -1437831800.217152 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=57216, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289395629, ack=2319613175, hl=20, dl=0, reserved=0, flags=16, win=8179], udp=, icmp=] -1437831800.217152 event_queue_flush_point -1437831800.217152 event_queue_flush_point -1437831800.217404 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 251.811981 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 251.811981 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=76, id=50813, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319613175, ack=3289395629, hl=20, dl=36, reserved=0, flags=24, win=4237], udp=, icmp=] -1437831800.217404 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 251.811981 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 251.811981 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x00\x1f\x86\xcbd\x09A\xce\xf6\x10BC*\xde\xe9\x1a\x0e\B\xccr\xbe\xe4\xe4A`+[\x19\x9dh/\x0b -1437831800.217404 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 251.811981 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=10, num_bytes_ip=3443, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 251.811981 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 3032 @@ -9343,17 +9340,17 @@ [5] len: count = 36 [6] payload: string = \x17\x03\x03\x00\x1f\x86\xcbd\x09A\xce\xf6\x10BC*\xde\xe9\x1a\x0e\B\xccr\xbe\xe4\xe4A`+[\x19\x9dh/\x0b -1437831800.217404 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=90, cap_len=90, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=76, id=50813, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319613175, ack=3289395629, hl=20, dl=36, reserved=0, flags=24, win=4237], udp=, icmp=] -1437831800.217404 event_queue_flush_point -1437831800.217404 event_queue_flush_point -1437831800.217470 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 317.853928 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 317.853928 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=61089, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289395629, ack=2319613211, hl=20, dl=0, reserved=0, flags=16, win=8190], udp=, icmp=] -1437831800.217470 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 317.853928 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=12, num_bytes_ip=2753, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3067, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 317.853928 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 2250 @@ -9361,21 +9358,21 @@ [5] len: count = 0 [6] payload: string = -1437831800.217470 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=61089, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289395629, ack=2319613211, hl=20, dl=0, reserved=0, flags=16, win=8190], udp=, icmp=] -1437831800.217470 event_queue_flush_point -1437831800.217470 event_queue_flush_point -1437831800.217747 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3627, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 594.896317 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3627, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 594.896317 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=600, id=50815, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319613211, ack=3289395629, hl=20, dl=560, reserved=0, flags=24, win=4237], udp=, icmp=] -1437831800.217747 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3627, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 594.896317 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3627, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 594.896317 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x02+\xb3\x16\x88+\x1d\xcc#\xdb\x91;d\xe5&\xa2\xa7\x12\x19W<\xb3m\xe7d\x89\x98f\x98}J\x0c\xdb\x0d\xba\xe1A\xf5\xeb\x90 yY\xa5\x82O\x85\xd0\x02\xbc\x1d\xa6w\x9a\xe8\xfe5\x91\xcfkrwn,\x12\xc0'\xe2\xb5\xf8\xff\x15\xfd\xc9Kq\x1fY\xfb1p\xd6\x11;7\x89\xc4\xddQ]\x19C\xcf\x80\xac\xbc\xa1\x8ch\xb0\x87e3\x85-o\x17\xbc@\xb5M\x82\x82Q\x93$!G1~\xa5"\x8aE\xc3\x83\xd7\x8d\xa1H\xa4\x84\x8c\xab\x84T\xc56\x89\x16\xa9Q\x1d\x8e\xc0\xa0\xe2\x01\x02\x8e=\xce\x7f{\xc6E\xf3Z\xd9\x059\x19:\xfc\x19\xe7Tb6_\x02\x9eH#\x86\xae\xfe\xac\xe3\xbe\xfb\xc2\xb9$;\x0e\x0e,7\x09\xac.\x96\x008\xdax\xbd\xef\x88\x1e@\x98\x97\x97\xb6A\x0c\xf2^\x87\x036\xe3@\x9d\x08\xf5\xb4\x9ay\xd4AIc\x08P\x95\xfd\xde\x9a23\xd8\x047>C\x81g{\x0d\xd9\xb4\x99\xc2\xd5\x8e?\xb9\x1d\x9di\x14\xdd\x98Q\xd4\x12\x18\x07\x02\x1cr\xb8%6T0\xb5l\x1e\xa9\x85U\x8d\xc5=`Q\xa2\x05lF\x96\x9d\xf0\xdd\xe0\xb5T:K\x94O\x81\x97\xaa\xd9\x1dQE\xfd\xa6C\xbc\xd9\xaa\xcc\xef{\x14Z\xfc\x0d\xaez4\x96\xa2q\x91\x9aN{@Y\xef\x1dt\xe06\x9e\xd7\xd9H\xdbw\xed{\xf6\Y\xf4\x96l\xd9\\xb5\x0fH\xcf-\xf1\x1c\xf5\x9a%\x06\x8e\xde\xbbk\xa5\N\xbf\x16\xea_SN\xa4\x1fp\x93TY\x1f\xf0\x08=\x9al\x83)\xf1."z\xd2Z\x1a\xe8.N\xe74\x7f\xa6l};\xe3\x86\x8d\x85v\x0c\x9a\xd3'T\xac\x8a\x9a\\xc0\xdf5h\xd3\xd0\x06, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3627, state=4, num_pkts=11, num_bytes_ip=3519, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 594.896317 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 3068 @@ -9383,21 +9380,21 @@ [5] len: count = 560 [6] payload: string = \x17\x03\x03\x02+\xb3\x16\x88+\x1d\xcc#\xdb\x91;d\xe5&\xa2\xa7\x12\x19W<\xb3m\xe7d\x89\x98f\x98}J\x0c\xdb\x0d\xba\xe1A\xf5\xeb\x90 yY\xa5\x82O\x85\xd0\x02\xbc\x1d\xa6w\x9a\xe8\xfe5\x91\xcfkrwn,\x12\xc0'\xe2\xb5\xf8\xff\x15\xfd\xc9Kq\x1fY\xfb1p\xd6\x11;7\x89\xc4\xddQ]\x19C\xcf\x80\xac\xbc\xa1\x8ch\xb0\x87e3\x85-o\x17\xbc@\xb5M\x82\x82Q\x93$!G1~\xa5"\x8aE\xc3\x83\xd7\x8d\xa1H\xa4\x84\x8c\xab\x84T\xc56\x89\x16\xa9Q\x1d\x8e\xc0\xa0\xe2\x01\x02\x8e=\xce\x7f{\xc6E\xf3Z\xd9\x059\x19:\xfc\x19\xe7Tb6_\x02\x9eH#\x86\xae\xfe\xac\xe3\xbe\xfb\xc2\xb9$;\x0e\x0e,7\x09\xac.\x96\x008\xdax\xbd\xef\x88\x1e@\x98\x97\x97\xb6A\x0c\xf2^\x87\x036\xe3@\x9d\x08\xf5\xb4\x9ay\xd4AIc\x08P\x95\xfd\xde\x9a23\xd8\x047>C\x81g{\x0d\xd9\xb4\x99\xc2\xd5\x8e?\xb9\x1d\x9di\x14\xdd\x98Q\xd4\x12\x18\x07\x02\x1cr\xb8%6T0\xb5l\x1e\xa9\x85U\x8d\xc5=`Q\xa2\x05lF\x96\x9d\xf0\xdd\xe0\xb5T:K\x94O\x81\x97\xaa\xd9\x1dQE\xfd\xa6C\xbc\xd9\xaa\xcc\xef{\x14Z\xfc\x0d\xaez4\x96\xa2q\x91\x9aN{@Y\xef\x1dt\xe06\x9e\xd7\xd9H\xdbw\xed{\xf6\Y\xf4\x96l\xd9\\xb5\x0fH\xcf-\xf1\x1c\xf5\x9a%\x06\x8e\xde\xbbk\xa5\N\xbf\x16\xea_SN\xa4\x1fp\x93TY\x1f\xf0\x08=\x9al\x83)\xf1."z\xd2Z\x1a\xe8.N\xe74\x7f\xa6l};\xe3\x86\x8d\x85v\x0c\x9a\xd3'T\xac\x8a\x9a\\xc0\xdf5h\xd3\xd0\x06, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=600, id=50815, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319613211, ack=3289395629, hl=20, dl=560, reserved=0, flags=24, win=4237], udp=, icmp=] -1437831800.217747 event_queue_flush_point -1437831800.217747 event_queue_flush_point -1437831800.217786 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=12, num_bytes_ip=4119, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 633.996964 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=12, num_bytes_ip=4119, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 633.996964 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=66, id=50817, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319613771, ack=3289395629, hl=20, dl=26, reserved=0, flags=24, win=4345], udp=, icmp=] -1437831800.217786 packet_contents - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=12, num_bytes_ip=4119, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 633.996964 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX packet_contents + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=12, num_bytes_ip=4119, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 633.996964 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] contents: string = \x17\x03\x03\x00\x15m\xfc&\xad\x07\xf2\xc9\xc3\xd3\xae/X\x8c=\xa4q\xec\xc09M\x1c -1437831800.217786 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=12, num_bytes_ip=4119, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 633.996964 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=12, num_bytes_ip=4119, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 633.996964 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] flags: string = AP [3] seq: count = 3628 @@ -9405,17 +9402,17 @@ [5] len: count = 26 [6] payload: string = \x17\x03\x03\x00\x15m\xfc&\xad\x07\xf2\xc9\xc3\xd3\xae/X\x8c=\xa4q\xec\xc09M\x1c -1437831800.217786 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=80, cap_len=80, src=cc:b2:55:f4:62:92, dst=58:b0:35:86:54:8d, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=66, id=50817, ttl=243, p=6, src=17.167.150.73, dst=192.168.133.100], ip6=, tcp=[sport=443/tcp, dport=49655/tcp, seq=2319613771, ack=3289395629, hl=20, dl=26, reserved=0, flags=24, win=4345], udp=, icmp=] -1437831800.217786 event_queue_flush_point -1437831800.217786 event_queue_flush_point -1437831800.217819 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 666.898727 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 666.898727 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=42793, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289395629, ack=2319613771, hl=20, dl=0, reserved=0, flags=16, win=8174], udp=, icmp=] -1437831800.217819 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 666.898727 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=13, num_bytes_ip=2793, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 666.898727 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 2250 @@ -9423,17 +9420,17 @@ [5] len: count = 0 [6] payload: string = -1437831800.217819 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=42793, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289395629, ack=2319613771, hl=20, dl=0, reserved=0, flags=16, win=8174], udp=, icmp=] -1437831800.217819 event_queue_flush_point -1437831800.217819 event_queue_flush_point -1437831800.217854 new_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=14, num_bytes_ip=2833, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX new_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=14, num_bytes_ip=2833, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] p: pkt_hdr = [ip=[hl=20, tos=0, len=40, id=11881, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289395629, ack=2319613797, hl=20, dl=0, reserved=0, flags=16, win=8173], udp=, icmp=] -1437831800.217854 tcp_packet - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=14, num_bytes_ip=2833, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX tcp_packet + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=14, num_bytes_ip=2833, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = T [2] flags: string = A [3] seq: count = 2250 @@ -9441,72 +9438,72 @@ [5] len: count = 0 [6] payload: string = -1437831800.217854 raw_packet +XXXXXXXXXX.XXXXXX raw_packet [0] p: raw_pkt_hdr = [l2=[encap=LINK_ETHERNET, len=54, cap_len=54, src=58:b0:35:86:54:8d, dst=cc:b2:55:f4:62:92, vlan=, inner_vlan=, eth_type=2048, proto=L3_IPV4], ip=[hl=20, tos=0, len=40, id=11881, ttl=64, p=6, src=192.168.133.100, dst=17.167.150.73], ip6=, tcp=[sport=49655/tcp, dport=443/tcp, seq=3289395629, ack=2319613797, hl=20, dl=0, reserved=0, flags=16, win=8173], udp=, icmp=] -1437831800.217854 event_queue_flush_point -1437831800.217854 event_queue_flush_point -1437831800.217854 Pcap::file_done +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Pcap::file_done -1437831800.217854 event_queue_flush_point -1437831800.217854 event_queue_flush_point -1437831800.217854 event_queue_flush_point -1437831800.217854 net_done - [0] t: time = 1437831800.217854 +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX net_done + [0] t: time = XXXXXXXXXX.XXXXXX -1437831800.217854 Broker::log_flush -1437831800.217854 filter_change_tracking -1437831800.217854 event_queue_flush_point -1437831800.217854 event_queue_flush_point -1437831800.217854 connection_pending - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=15, num_bytes_ip=2873, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX Broker::log_flush +XXXXXXXXXX.XXXXXX filter_change_tracking +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX connection_pending + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=15, num_bytes_ip=2873, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=15, num_bytes_ip=2873, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.461152, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=1437831799.611764, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, server_appdata=0, client_appdata=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=1437831799.764576, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=1437831799.764576, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=1424184331.0, not_valid_after=1489848331.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=1437831799.764576, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=1437831799.764576, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=1402933322.0, not_valid_after=1653061322.0, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], orig=[size=2249, state=4, num_pkts=15, num_bytes_ip=2873, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=3653, state=4, num_pkts=13, num_bytes_ip=4185, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=756.0 msecs 701.946259 usecs, service={\x0aSSL\x0a}, history=ShADda, uid=C3eiCBGOLw3VtHfOj, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SSL::finalize_ssl\x0a\x09{ \x0a\x09if (!SSL::c?$ssl) \x0a\x09\x09return ;\x0a\x0a\x09if (!SSL::c$ssl$logged) \x0a\x09\x09SSL::ssl_finishing(SSL::c);\x0a\x0a\x09inline(SSL::c, F){{ \x0a\x09SSL::log_record(SSL::c$ssl);\x0a\x09if (SSL::remove_analyzer && SSL::disable_analyzer_after_detection && SSL::c?$ssl && SSL::c$ssl?$analyzer_id) \x0a\x09\x09{ \x0a\x09\x09disable_analyzer(SSL::c$id, SSL::c$ssl$analyzer_id, T, F);\x0a\x09\x09delete SSL::c$ssl$analyzer_id;\x0a\x09\x09}\x0a\x0a\x09}};\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=[ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], version_num=771, version=TLSv12, cipher=TLS_RSA_WITH_RC4_128_MD5, curve=, server_name=p31-keyvalueservice.icloud.com, session_id=, resumed=F, client_ticket_empty_session_seen=F, client_key_exchange_seen=T, client_psk_seen=F, last_alert=, next_protocol=, analyzer_id=, established=T, logged=T, delay_tokens=, cert_chain=[[ts=XXXXXXXXXX.XXXXXX, fuid=FTerEX1QTrF67YJcA3, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-user-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1406, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=1bf9696d9f337805383427e88781d001, sha1=f5ccb1a724133607548b00d8eb402efca3076d58, sha256=f94f3f5bf51899148fa4c51a1b39bd98cd0bf053f2e838eb68a2a96d0359ed56, x509=[ts=XXXXXXXXXX.XXXXXX, id=FTerEX1QTrF67YJcA3, certificate=[version=3, serial=053FCE9BA6805B00, subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, cn=*.icloud.com, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com]], san=[dns=[*.icloud.com], uri=, email=, ip=, other_fields=F], basic_constraints=[ca=F, path_len=], extensions_cache=[[name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://ocsp.apple.com/ocsp04-appleistca2g101\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=8E:51:A1:0E:0A:9B:1C:04:F7:59:D3:69:2E:23:16:91:0E:AD:06:FB], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:FALSE], [ca=F, path_len=], [name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 1.2.840.113635.100.5.11.4\x0a User Notice:\x0a Explicit Text: Reliance on this certificate by any party assumes acceptance of any applicable terms and conditions of use and/or certification practice statements.\x0a CPS: http://www.apple.com/certificateauthority/rpa\x0a], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://crl.apple.com/appleistca2g1.crl\x0a], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Digital Signature, Key Encipherment], [name=X509v3 Extended Key Usage, short_name=extendedKeyUsage, oid=2.5.29.37, critical=F, value=TLS Web Server Authentication, TLS Web Client Authentication], [name=X509v3 Subject Alternative Name, short_name=subjectAltName, oid=2.5.29.17, critical=F, value=DNS:*.icloud.com], [dns=[*.icloud.com], uri=, email=, ip=, other_fields=F]]], extracted=, extracted_cutoff=, extracted_size=], [ts=XXXXXXXXXX.XXXXXX, fuid=F58hAEwidvB37CYEf, tx_hosts={\x0a\x0917.167.150.73\x0a}, rx_hosts={\x0a\x09192.168.133.100\x0a}, conn_uids={\x0aC3eiCBGOLw3VtHfOj\x0a}, source=SSL, depth=0, analyzers={\x0aSHA256,\x0aX509,\x0aSHA1,\x0aMD5\x0a}, mime_type=application/x-x509-ca-cert, filename=, duration=0 secs, local_orig=, is_orig=F, seen_bytes=1092, total_bytes=, missing_bytes=0, overflow_bytes=0, timedout=F, parent_fuid=, md5=48f0e38385112eeca5fc9ffd402eaecd, sha1=8e8321ca08b08e3726fe1d82996884eeb5f0d655, sha256=ac2b922ecfd5e01711772fea8ed372de9d1e2245fce3f57a9cdbec77296a424b, x509=[ts=XXXXXXXXXX.XXXXXX, id=F58hAEwidvB37CYEf, certificate=[version=3, serial=023A74, subject=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, issuer=CN=GeoTrust Global CA,O=GeoTrust Inc.,C=US, cn=Apple IST CA 2 - G1, not_valid_before=XXXXXXXXXX.XXXXXX, not_valid_after=XXXXXXXXXX.XXXXXX, key_alg=rsaEncryption, sig_alg=sha256WithRSAEncryption, key_type=rsa, key_length=2048, exponent=65537, curve=], handle=, extensions=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]], san=, basic_constraints=[ca=T, path_len=0], extensions_cache=[[name=X509v3 Authority Key Identifier, short_name=authorityKeyIdentifier, oid=2.5.29.35, critical=F, value=keyid:C0:7A:98:68:8D:89:FB:AB:05:64:0C:11:7D:AA:7D:65:B8:CA:CC:4E\x0a], [name=X509v3 Subject Key Identifier, short_name=subjectKeyIdentifier, oid=2.5.29.14, critical=F, value=D8:7A:94:44:7C:90:70:90:16:9E:DD:17:9C:01:44:03:86:D6:2A:29], [name=X509v3 Basic Constraints, short_name=basicConstraints, oid=2.5.29.19, critical=T, value=CA:TRUE, pathlen:0], [ca=T, path_len=0], [name=X509v3 Key Usage, short_name=keyUsage, oid=2.5.29.15, critical=T, value=Certificate Sign, CRL Sign], [name=X509v3 CRL Distribution Points, short_name=crlDistributionPoints, oid=2.5.29.31, critical=F, value=\x0aFull Name:\x0a URI:http://g.symcb.com/crls/gtglobal.crl\x0a], [name=Authority Information Access, short_name=authorityInfoAccess, oid=1.3.6.1.5.5.7.1.1, critical=F, value=OCSP - URI:http://g.symcd.com\x0a], [name=X509v3 Certificate Policies, short_name=certificatePolicies, oid=2.5.29.32, critical=F, value=Policy: 2.16.840.1.113733.1.7.54\x0a CPS: http://www.geotrust.com/resources/cps\x0a]]], extracted=, extracted_cutoff=, extracted_size=]], cert_chain_fuids=[FTerEX1QTrF67YJcA3, F58hAEwidvB37CYEf], client_cert_chain=[], client_cert_chain_fuids=[], subject=C=US,ST=California,O=Apple Inc.,OU=management:idms.group.506364,CN=*.icloud.com, issuer=C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple IST CA 2 - G1, client_subject=, client_issuer=, server_depth=0, client_depth=0], http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_pending - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_pending + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831799.262632, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], orig=[size=714, state=3, num_pkts=1, num_bytes_ip=766, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=147.0 msecs 503.137589 usecs, service={\x0a\x0a}, history=Da, uid=C37jN32gN3y3AZzyf6, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_pending - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_pending + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831776.764391, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], orig=[size=41, state=3, num_pkts=1, num_bytes_ip=93, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=0, state=3, num_pkts=1, num_bytes_ip=52, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=343.0 msecs 8.041382 usecs, service={\x0a\x0a}, history=Da, uid=CUM0KZ3MLUfNB0cl11, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_pending - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=3, num_bytes_ip=156, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_pending + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=3, num_bytes_ip=156, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=3, num_bytes_ip=156, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=1437831798.533593, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], orig=[size=0, state=3, num_pkts=3, num_bytes_ip=156, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=3, num_pkts=3, num_bytes_ip=411, flow_label=0, l2_addr=cc:b2:55:f4:62:92], start_time=XXXXXXXXXX.XXXXXX, duration=221.014023 usecs, service={\x0a\x0a}, history=^dtA, uid=CP5puj4I8PtEU4qzYg, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] -1437831800.217854 connection_pending - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=17, num_bytes_ip=1865, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_pending + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=17, num_bytes_ip=1865, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] -1437831800.217854 connection_state_remove - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=17, num_bytes_ip=1865, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.914113, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX connection_state_remove + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=17, num_bytes_ip=1865, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=10, num_bytes_ip=690, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 320.11795 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=2, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=1, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] -1437831800.217854 event_queue_flush_point -1437831800.217854 Conn::log_conn - [0] rec: Conn::Info = [ts=1437831799.461152, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], proto=tcp, service=ssl, duration=756.0 msecs 701.946259 usecs, orig_bytes=2249, resp_bytes=3653, conn_state=S1, local_orig=, local_resp=, missed_bytes=0, history=ShADda, orig_pkts=15, orig_ip_bytes=2873, resp_pkts=13, resp_ip_bytes=4185, tunnel_parents=] +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=C3eiCBGOLw3VtHfOj, id=[orig_h=192.168.133.100, orig_p=49655/tcp, resp_h=17.167.150.73, resp_p=443/tcp], proto=tcp, service=ssl, duration=756.0 msecs 701.946259 usecs, orig_bytes=2249, resp_bytes=3653, conn_state=S1, local_orig=, local_resp=, missed_bytes=0, history=ShADda, orig_pkts=15, orig_ip_bytes=2873, resp_pkts=13, resp_ip_bytes=4185, tunnel_parents=] -1437831800.217854 Conn::log_conn - [0] rec: Conn::Info = [ts=1437831799.262632, uid=C37jN32gN3y3AZzyf6, id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], proto=tcp, service=, duration=147.0 msecs 503.137589 usecs, orig_bytes=714, resp_bytes=0, conn_state=OTH, local_orig=, local_resp=, missed_bytes=0, history=Da, orig_pkts=1, orig_ip_bytes=766, resp_pkts=1, resp_ip_bytes=52, tunnel_parents=] +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=C37jN32gN3y3AZzyf6, id=[orig_h=192.168.133.100, orig_p=49153/tcp, resp_h=17.172.238.21, resp_p=5223/tcp], proto=tcp, service=, duration=147.0 msecs 503.137589 usecs, orig_bytes=714, resp_bytes=0, conn_state=OTH, local_orig=, local_resp=, missed_bytes=0, history=Da, orig_pkts=1, orig_ip_bytes=766, resp_pkts=1, resp_ip_bytes=52, tunnel_parents=] -1437831800.217854 Conn::log_conn - [0] rec: Conn::Info = [ts=1437831776.764391, uid=CUM0KZ3MLUfNB0cl11, id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], proto=tcp, service=, duration=343.0 msecs 8.041382 usecs, orig_bytes=41, resp_bytes=0, conn_state=OTH, local_orig=, local_resp=, missed_bytes=0, history=Da, orig_pkts=1, orig_ip_bytes=93, resp_pkts=1, resp_ip_bytes=52, tunnel_parents=] +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=CUM0KZ3MLUfNB0cl11, id=[orig_h=192.168.133.100, orig_p=49285/tcp, resp_h=66.196.121.26, resp_p=5050/tcp], proto=tcp, service=, duration=343.0 msecs 8.041382 usecs, orig_bytes=41, resp_bytes=0, conn_state=OTH, local_orig=, local_resp=, missed_bytes=0, history=Da, orig_pkts=1, orig_ip_bytes=93, resp_pkts=1, resp_ip_bytes=52, tunnel_parents=] -1437831800.217854 Conn::log_conn - [0] rec: Conn::Info = [ts=1437831798.533593, uid=CP5puj4I8PtEU4qzYg, id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], proto=tcp, service=, duration=221.014023 usecs, orig_bytes=0, resp_bytes=85, conn_state=OTH, local_orig=, local_resp=, missed_bytes=0, history=^dtA, orig_pkts=3, orig_ip_bytes=156, resp_pkts=3, resp_ip_bytes=411, tunnel_parents=] +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=CP5puj4I8PtEU4qzYg, id=[orig_h=192.168.133.100, orig_p=49336/tcp, resp_h=74.125.71.189, resp_p=443/tcp], proto=tcp, service=, duration=221.014023 usecs, orig_bytes=0, resp_bytes=85, conn_state=OTH, local_orig=, local_resp=, missed_bytes=0, history=^dtA, orig_pkts=3, orig_ip_bytes=156, resp_pkts=3, resp_ip_bytes=411, tunnel_parents=] -1437831800.217854 Conn::log_conn - [0] rec: Conn::Info = [ts=1437831787.856895, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], proto=tcp, service=smtp, duration=57.0 msecs 320.11795 usecs, orig_bytes=969, resp_bytes=162, conn_state=S1, local_orig=, local_resp=, missed_bytes=0, history=ShAdDa, orig_pkts=17, orig_ip_bytes=1865, resp_pkts=10, resp_ip_bytes=690, tunnel_parents=] +XXXXXXXXXX.XXXXXX Conn::log_conn + [0] rec: Conn::Info = [ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], proto=tcp, service=smtp, duration=57.0 msecs 320.11795 usecs, orig_bytes=969, resp_bytes=162, conn_state=S1, local_orig=, local_resp=, missed_bytes=0, history=ShAdDa, orig_pkts=17, orig_ip_bytes=1865, resp_pkts=10, resp_ip_bytes=690, tunnel_parents=] -1437831800.217854 event_queue_flush_point -1437831800.217854 zeek_done -1437831800.217854 event_queue_flush_point -1437831800.217854 ChecksumOffloading::check -1437831800.217854 event_queue_flush_point -1437831800.217854 event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX zeek_done +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX ChecksumOffloading::check +XXXXXXXXXX.XXXXXX event_queue_flush_point +XXXXXXXXXX.XXXXXX event_queue_flush_point diff --git a/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/smtp-events.log b/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/smtp-events.log index a0c5a249bf..da857df2ee 100644 --- a/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/smtp-events.log +++ b/testing/btest/Baseline.inline/scripts.policy.misc.dump-events/smtp-events.log @@ -1,317 +1,318 @@ -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 [5] cont_resp: bool = T -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 xc90.websitewelcome.com ESMTP Exim 4.69 #1 Mon, 05 Oct 2009 01:05:54 -0500 , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = We do not authorize the use of this system to transport unsolicited, [5] cont_resp: bool = T -1254722768.219663 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 We do not authorize the use of this system to transport unsolicited, , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=1, num_bytes_ip=48, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=690.0 msecs 616.846085 usecs, service={\x0a\x0a}, history=ShAd, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 We do not authorize the use of this system to transport unsolicited, , path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = and/or bulk e-mail. [5] cont_resp: bool = F -1254722768.224809 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=695.0 msecs 762.872696 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=2, num_bytes_ip=88, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=181, state=4, num_pkts=2, num_bytes_ip=269, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=695.0 msecs 762.872696 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = EHLO [3] arg: string = GP -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 and/or bulk e-mail., path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = xc90.websitewelcome.com Hello GP [122.162.143.157] [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 xc90.websitewelcome.com Hello GP [122.162.143.157], path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 xc90.websitewelcome.com Hello GP [122.162.143.157], path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = SIZE 52428800 [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 SIZE 52428800, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 SIZE 52428800, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = PIPELINING [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 PIPELINING, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 PIPELINING, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = AUTH PLAIN LOGIN [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH PLAIN LOGIN, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH PLAIN LOGIN, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = STARTTLS [5] cont_resp: bool = T -1254722768.566183 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 STARTTLS, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=9, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=3, num_bytes_ip=309, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 37.0 msecs 137.031555 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 STARTTLS, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = HELP [5] cont_resp: bool = F -1254722768.568729 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=3, num_bytes_ip=137, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=318, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 39.0 msecs 682.865143 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = AUTH [3] arg: string = LOGIN -1254722768.911081 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=21, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=4, num_bytes_ip=486, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 35.017014 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 HELP, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 334 [3] cmd: string = AUTH [4] msg: string = VXNlcm5hbWU6 [5] cont_resp: bool = F -1254722768.911655 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=4, num_bytes_ip=189, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=336, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 382.0 msecs 608.890533 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = ** [3] arg: string = Z3VycGFydGFwQHBhdHJpb3RzLmlu -1254722769.253544 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=51, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=5, num_bytes_ip=544, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 724.0 msecs 498.033524 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 VXNlcm5hbWU6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 334 [3] cmd: string = AUTH_ANSWER [4] msg: string = UGFzc3dvcmQ6 [5] cont_resp: bool = F -1254722769.254118 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=5, num_bytes_ip=259, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=354, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=1.0 sec 725.0 msecs 71.907043 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = ** [3] arg: string = cHVuamFiQDEyMw== -1254722769.613798 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=69, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=6, num_bytes_ip=602, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 84.0 msecs 751.844406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=334 UGFzc3dvcmQ6, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 235 [3] cmd: string = AUTH_ANSWER [4] msg: string = Authentication succeeded [5] cont_resp: bool = F -1254722769.614414 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=6, num_bytes_ip=317, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=384, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 85.0 msecs 367.918015 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = MAIL [3] arg: string = FROM: -1254722769.956765 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 427.0 msecs 718.877792 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = MAIL [4] msg: string = OK [5] cont_resp: bool = F -1254722769.957250 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 428.0 msecs 204.059601 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1254722770.319708 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 790.0 msecs 662.050247 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Accepted [5] cont_resp: bool = F -1254722770.320203 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=2.0 secs 791.0 msecs 157.007217 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = DATA [3] arg: string = -1254722770.661679 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=150, state=4, num_pkts=9, num_bytes_ip=518, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=9, num_bytes_ip=774, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=3.0 secs 132.0 msecs 632.97081 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Accepted, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 354 [3] cmd: string = DATA [4] msg: string = Enter message, ending with "." on a line by itself [5] cont_resp: bool = F -1254722771.858334 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=23, num_bytes_ip=21438, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=462, state=4, num_pkts=15, num_bytes_ip=1070, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 329.0 msecs 288.005829 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = . [3] arg: string = . -1254722772.248789 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722768.219663, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14699, state=4, num_pkts=24, num_bytes_ip=21507, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=21, num_bytes_ip=1310, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=4.0 secs 719.0 msecs 743.013382 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto={\x0araj_deol2002in@yahoo.co.in\x0a}, date=Mon, 5 Oct 2009 11:36:07 +0530, from="Gurpartap Singh" , to={\x0a\x0a}, cc=, reply_to=, msg_id=<000301ca4581$ef9e57f0$cedb07d0$@in>, in_reply_to=, subject=SMTP, x_originating_ip=, first_received=, second_received=, last_reply=354 Enter message, ending with "." on a line by itself, path=[74.53.140.153, 10.10.1.4], user_agent=Microsoft Office Outlook 12.0, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=F, entity_count=5, entity=, fuids=[FmFp351N5nhsMmAfQg, Fqrb1K5DWEfgy4WU2, FEFYSd1s8Onn9LynKj]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = . [4] msg: string = OK id=1Mugho-0003Dg-Un [5] cont_resp: bool = F -1254722774.763825 smtp_request - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=4, num_pkts=25, num_bytes_ip=21547, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=490, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 234.0 msecs 778.881073 usecs, service={\x0aSMTP\x0a}, history=ShAdDaT, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = QUIT [3] arg: string = -1254722775.105467 smtp_reply - [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1254722772.248789, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=14705, state=5, num_pkts=27, num_bytes_ip=21633, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=538, state=4, num_pkts=22, num_bytes_ip=1378, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=XXXXXXXXXX.XXXXXX, duration=7.0 secs 576.0 msecs 421.022415 usecs, service={\x0aSMTP\x0a}, history=ShAdDaTF, uid=ClEkJM2Vm5giqnMf4h, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=ClEkJM2Vm5giqnMf4h, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=2, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=1, pending_messages=, mime_depth=5], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 221 [3] cmd: string = QUIT [4] msg: string = xc90.websitewelcome.com closing connection [5] cont_resp: bool = F -1437831787.867142 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=0, state=4, num_pkts=2, num_bytes_ip=116, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=1, num_bytes_ip=60, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=10.0 msecs 246.992111 usecs, service={\x0a\x0a}, history=ShAd, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks=, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=, smtp_state=, socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 220 [3] cmd: string = > [4] msg: string = uprise ESMTP SubEthaSMTP null [5] cont_resp: bool = F -1437831787.883306 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=26.0 msecs 411.056519 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=3, num_bytes_ip=168, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=35, state=4, num_pkts=2, num_bytes_ip=147, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=26.0 msecs 411.056519 usecs, service={\x0aSMTP\x0a}, history=ShAdD, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = EHLO [3] arg: string = [192.168.133.100] -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=220 uprise ESMTP SubEthaSMTP null, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = uprise [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 uprise, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 uprise, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = 8BITMIME [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 8BITMIME, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 8BITMIME, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = AUTH LOGIN [5] cont_resp: bool = T -1437831787.886281 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH LOGIN, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=24, state=4, num_pkts=4, num_bytes_ip=244, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=3, num_bytes_ip=199, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=29.0 msecs 386.043549 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 AUTH LOGIN, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = EHLO [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.887031 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=5, num_bytes_ip=296, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=85, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=30.0 msecs 136.108398 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=F, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = MAIL [3] arg: string = FROM: -1437831787.889785 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=56, state=4, num_pkts=6, num_bytes_ip=380, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=4, num_bytes_ip=301, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=32.0 msecs 890.081406 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = MAIL [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.890232 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=7, num_bytes_ip=432, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=93, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=33.0 msecs 337.116241 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.892986 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=88, state=4, num_pkts=8, num_bytes_ip=516, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=5, num_bytes_ip=361, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 91.089249 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.893587 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=9, num_bytes_ip=568, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=101, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=36.0 msecs 692.142487 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.897624 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=121, state=4, num_pkts=10, num_bytes_ip=653, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=6, num_bytes_ip=421, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=40.0 msecs 729.045868 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.898413 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=11, num_bytes_ip=705, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=109, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=41.0 msecs 517.972946 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = RCPT [3] arg: string = TO: -1437831787.901069 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=156, state=4, num_pkts=12, num_bytes_ip=792, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=7, num_bytes_ip=481, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 173.955917 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = RCPT [4] msg: string = Ok [5] cont_resp: bool = F -1437831787.901697 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=13, num_bytes_ip=844, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=117, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=44.0 msecs 801.950455 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=0, entity=, fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = DATA [3] arg: string = -1437831787.904758 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=162, state=4, num_pkts=14, num_bytes_ip=902, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=8, num_bytes_ip=541, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=47.0 msecs 863.006592 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 Ok, path=[192.168.133.102, 192.168.133.100], user_agent=, tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=[filename=], fuids=[]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 354 [3] cmd: string = DATA [4] msg: string = End data with . [5] cont_resp: bool = F -1437831787.905375 smtp_request - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_request + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=15, num_bytes_ip=954, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=154, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=48.0 msecs 480.033875 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = T [2] command: string = . [3] arg: string = . -1437831787.914113 smtp_reply - [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=1437831787.856895, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, SMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=1437831787.867142, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] +XXXXXXXXXX.XXXXXX smtp_reply + [0] c: connection = [id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], orig=[size=969, state=4, num_pkts=16, num_bytes_ip=1813, flow_label=0, l2_addr=58:b0:35:86:54:8d], resp=[size=162, state=4, num_pkts=9, num_bytes_ip=630, flow_label=0, l2_addr=00:08:ca:cc:ad:4c], start_time=XXXXXXXXXX.XXXXXX, duration=57.0 msecs 218.074799 usecs, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CmES5u32sYpV7JYN, tunnel=, vlan=, inner_vlan=, dpd=, dpd_state=, removal_hooks={\x0a\x09SMTP::finalize_smtp\x0a\x09{ \x0a\x09if (SMTP::c?$smtp) \x0a\x09\x09inline(SMTP::c){{ \x0a\x09\x09if (SMTP::c$smtp$has_client_activity) \x0a\x09\x09\x09{ \x0a\x09\x09\x09inline(SMTP::LOG, to_any_coerceSMTP::c$smtp){{ \x0a\x09\x09\x09return (Log::__write(Log::id, Log::columns));\x0a\x09\x09\x09}};\x0a\x09\x09\x09SMTP::c$smtp = inline(SMTP::c){{ \x0a\x09\x09\x09 SMTP::l;\x0a\x09\x09\x09{ \x0a\x09\x09\x09;\x0a\x09\x09\x09SMTP::l$ts = network_time();\x0a\x09\x09\x09SMTP::l$uid = SMTP::c$uid;\x0a\x09\x09\x09SMTP::l$id = SMTP::c$id;\x0a\x09\x09\x09SMTP::l$trans_depth = SMTP::c$smtp_state$messages_transferred + 1;\x0a\x09\x09\x09if (SMTP::c$smtp_state?$helo) \x0a\x09\x09\x09\x09SMTP::l$helo = SMTP::c$smtp_state$helo;\x0a\x0a\x09\x09\x09SMTP::l$path = vector(SMTP::c$id$resp_h, SMTP::c$id$orig_h);\x0a\x09\x09\x09inline(SMTP::c, SMTP::finalize_smtp){{ \x0a\x09\x09\x09if (Conn::c?$removal_hooks) \x0a\x09\x09\x09\x09{ \x0a\x09\x09\x09\x09if (Conn::hk in Conn::c$removal_hooks) \x0a\x09\x09\x09\x09\x09return (F);\x0a\x0a\x09\x09\x09\x09add Conn::c$removal_hooks[Conn::hk];\x0a\x09\x09\x09\x09return (T);\x0a\x09\x09\x09\x09}\x0a\x0a\x09\x09\x09Conn::c$removal_hooks = set(Conn::hk);\x0a\x09\x09\x09return (T);\x0a\x09\x09\x09}};\x0a\x09\x09\x09return (SMTP::l);\x0a\x09\x09\x09}\x0a\x09\x09\x09}};\x0a\x09\x09\x09}\x0a\x0a\x09\x09}};\x0a\x0a\x09}\x0a}, conn=, extract_orig=F, extract_resp=F, thresholds=, dce_rpc=, dce_rpc_state=, dce_rpc_backing=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, ntlm=, ntp=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smb_state=, smtp=[ts=XXXXXXXXXX.XXXXXX, uid=CmES5u32sYpV7JYN, id=[orig_h=192.168.133.100, orig_p=49648/tcp, resp_h=192.168.133.102, resp_p=25/tcp], trans_depth=1, helo=[192.168.133.100], mailfrom=albert@example.com, rcptto={\x0afelica4uu@hotmail.com,\x0aericlim220@yahoo.com,\x0adavis_mark1@outlook.com\x0a}, date=Sat, 25 Jul 2015 16:43:07 +0300, from=Albert Zaharovits , to={\x0aericlim220@yahoo.com\x0a}, cc={\x0afelica4uu@hotmail.com,\x0adavis_mark1@outlook.com\x0a}, reply_to=, msg_id=, in_reply_to=<9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com>, subject=Re: Bro SMTP CC Header, x_originating_ip=, first_received=, second_received=, last_reply=354 End data with ., path=[192.168.133.102, 192.168.133.100], user_agent=Apple Mail (2.2102), tls=F, process_received_from=T, has_client_activity=T, process_smtp_headers=T, entity_count=1, entity=, fuids=[Fc5KpS3kUYqDLwWSMf]], smtp_state=[helo=[192.168.133.100], messages_transferred=0, pending_messages=, mime_depth=1], socks=, ssh=, syslog=] [1] is_orig: bool = F [2] code: count = 250 [3] cmd: string = .